Writing a loader with Assembly (SuspendThread -> Apply -> ResumeThread)

[moork]

Ok, umm lets start with a few common questions.​

1. What is a loader?

A loader is a program able to load in memory and running another program. Every time you start a program the standard window loader make this work for
you in invisible way. There is many type of loader but basically every loader can be classified in two classes:
• Standard loader
• Debugger loader

This is a skeleton of a standard loader, which i wrote because i thought this might help you debug your programs, apply patches through SuspendThread & learn more about ASM and its features for writing small programs.
A chart on how loaders work:



And here's the skeleton finally:

.386
.model flat,stdcall
option casemap:none

include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc

includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib

.data
target db "FileNameHere.exe",0
writebuf db 90h,90h,90h,90h,90h
fr_er db "Process not created",0 ;if something goes wrong
se_er db "Couldn't write ...",0 ;something goes wrong
.data?
hInstance dd ?
startinfo STARTUPINFO <?> ;the startupinfo structure
pi PROCESS_INFORMATION <?> ;the process_information structure
.code
start:
;-->get handle of our loader
invoke GetModuleHandle,NULL
mov hInstance,eax
;-->create the process
invoke CreateProcess,addr target,NULL,NULL,NULL,FALSE,NORMAL_PRIORITY_CLASS,NULL,NULL, addr startinfo,addr pi
cmp eax,0 ;error ??
jz eror_1
;-->Wait for full process write into memory
invoke WaitForInputIdle,pi.hProcess,INFINITE
;-->Write into PROCESS using WriteProcessMemory
INVOKE THE WRITEPROCESSMEMORY HERE
cmp eax,0 ;error??
jz eror_2
fin:
invoke ExitProcess,NULL
eror_1:
invoke MessageBoxA,NULL,addr fr_er,NULL,NULL
jmp fin
eror_2:
invoke MessageBoxA,NULL,addr se_er,NULL,NULL
jmp fin
end start

Hope this helped.

 

[cp]

If you made it, nice work. Sorta busy now, will look at later.