process - Files and processes share memory

Question

I am simply coding process following. It's not a malicious purpose, it's just for studying.

Notepad, a normal process, was run as CreateProcessA for process followings. And after initializing the memory of the process, I tried to put the PE file.

However, the memory of the notepad process and the PE file was shared and initialized to zero from the beginning of the PE file's MZ code.

Code

PVOID pFile() { 
HANDLE hFile = INVALID_HANDLE_VALUE;    //?? ???
DWORD rbytes = 0;
TCHAR buf[1025];
TCHAR PEfile[2048];
//PVOID HelloFile[2048];

//PE?? ?? OPEN
hFile = CreateFile(L"C:/Users/code1/Desktop/Hello", GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
if (hFile == INVALID_HANDLE_VALUE) {
    printf("Fail: Hello ??? ????.
");
}
else {
    printf("Success: Hello ??? ?????.
");
}

//PE?? ?? READ
if(ReadFile(hFile, buf, sizeof(buf), &rbytes, NULL) != 0){
    printf("MZ ?? ??: 0x%08x
?? ?? ?: %x
PE ??? ? ??? ?: %d

", buf, *buf, rbytes);
    
    for (int i = 0; i < rbytes/2; i++) {
        printf("%x ", *(buf+i));
        PEfile[i] = *(buf+i);
    }
    printf("
");
}
else{
    printf("Fail: ReadFile Fail.
");
}

//dump ??? ??
//dumpcode((unsigned char*)PEfile, rbytes);
return PEfile;

//PVOID FILE_PE = (PVOID)ReadFile(hFile, buf, sizeof(buf), &rbytes, NULL);
CloseHandle(hFile);
}


void ProcHollowing(LPSTR szFilePath /*TargetProc*/, PVOID pFile/*PE Data*/) {
PIMAGE_DOS_HEADER IDH;/*PE ??? ? ???? DOS ??*/
PIMAGE_NT_HEADERS INH;/*PE??*/
PIMAGE_SECTION_HEADER ISH; //?? ??
PROCESS_INFORMATION PI; //???? ??
STARTUPINFOA SI; //??? ????? ?? ??? ????, ????, ?? ?? ? ? ?? ??? ???? ???.
PCONTEXT CTX;
PDWORD dwImageBase; //??? ????? Image Base ??
NtUnmapViewOfSection NewNtUnmapViewOfSection;
LPVOID pImageBase;
int Count;

IDH = PIMAGE_DOS_HEADER(pFile);

if (IDH->e_magic == IMAGE_DOS_SIGNATURE/*PE ??? ??? ????? ?? ????.*/) { //IMAGE_DOS_SIGNATURE? 4D5A ? MZ
    _tprintf(TEXT("SUCCESS: This is PE File
"));
    INH = PIMAGE_NT_HEADERS(ULONG_PTR(pFile) + IDH->e_lfanew); // Dos header? ??? + ?? ???? PE Header? ??? ?.

    if (INH->Signature == IMAGE_NT_SIGNATURE/*PE ???? ??*/) {
        _tprintf(TEXT("SUCCESS: PE FILE Check
"));

        printf("&SI: %x 
", &SI);
        printf("&PI: %x 
", &PI);

        RtlZeroMemory(&SI, sizeof(SI)); // SI? ???? 0?? ????? ??. ?, ???
        RtlZeroMemory(&PI, sizeof(PI));

        printf("INH->OptionalHeader.ImageBase: %x 
", LPVOID(INH->OptionalHeader.ImageBase));
        printf("INH->OptionalHeader.SizeOfImage: %x 
", INH->OptionalHeader.SizeOfImage);

        bool bResult = CreateProcessA("C:/Windows/System32/notepad.exe", (LPSTR)"C:/Windows/System32/notepad.exe", NULL, NULL,
            FALSE, CREATE_SUSPENDED, NULL, NULL, &SI, &PI); 

Error

bool bResult = CreateProcessA("C:/Windows/System32/notepad.exe", (LPSTR)"C:/Windows/System32/notepad.exe", NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &SI, &PI);

Starting that part initializes the memory with the PE file.

PE file before CreateProcessA
PE file after CreateProcessA

question from:https://stackoverflow.com/questions/65839352/files-and-processes-share-memory

Answer 1

Waitting for answers