VB6 Virtual Files
Author: Dave
Date: 10.14.23 - 10:01pm
So the python pefile module has the ability parse a PE files data from either a file path or a memory buffer. This is actually kinda nice because sometimes you extract a PE from a resource in memory and then want to switch over to that without a bunch of intermediate files dumped to disk and making AV spaz out on you.
Since I am primarily VB6 based, I already have my own PE file format parser I wrote like 20 years ago. Catch is it is file system based and uses advanced features of the VB Get statement to magically load entire structures from disk with a single call.
Its complex code to write and test, I do not want two different versions of the code one for in memory and one for on disk.
What is a guy to do?!
Well, if your lazy...you do some API hooking and then redirect the file system calls to work seamlessly off of an in memory buffer!
This code is not bulletproof, it blindly assumes all operations will be on a single file handle at this point, but if used carefully it will do the trick.
Experimental but fun. You can download the files here
Comments: (0)
|
About Me
More Blogs
Main Site
Posts: (year)
|