A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about user-mode development.
 #8626  by ArkKup
 Mon Sep 19, 2011 9:20 am
Hi,

I'm trying to run an executable from memory by loading it manual, allocating memory for header and sections then resolving import table, relocations and jump to entry point. It basically works but crashes when import table contains MFC42.DLL. I have hooked GetModuleHandle and return fake ImageBase (allocated exe memory) when its invoked with NULL but it didn't change anything. Anyone can give me some hint how to make it work with MFC42.DLL, or what other APIs should I maybe hook ?