How to run a PE image without linking kernel32.dll and ntdll.dll

前端 未结 3 915
慢半拍i
慢半拍i 2021-02-06 04:53

I tried to write a peloader. I first load the executable image and all it\'s dependent dlls(include kernel32.dll and ntdll.dll) into memory, process all import address table, re

3条回答
  •  终归单人心
    2021-02-06 05:35

    In visual studio put in the project properties linker->input->Ignore All default libraries to yes. Then in c++->Code Generation->Basic Runtime Check to default (to avoid linking in __RTC_*. Then in linker->Advanced->Entry Point you specify an function in your project you want to be called when the program is started.

    Build everything and you should have a program that isn't linked to any library, including the c-runtime.

提交回复
热议问题