When I got out of bed this morning, I had one of those crazy notions and I just had to try it.. I wondered if it was possible to use a Shared Memory Object (SMO) for CODE.
I wrote a proof of concept application which creates or opens a Shared Memory Object, and if it was just Created, copies some relocatable code into it and executes it.
The relocatable code obtains the base of ntdll, k32 and user32, and thus gains access to GetCurrentProcessId, wsprintf and messagebox.
It prints a messagebox showing the caller's PID, and returns to the caller.
What really was the most interesting aspect is that I asked for READ/WRITE access, NOT EXECUTABLE.. no page fault was generated either by the creating process or by subsequent processes who shared that code.

Sourcecode available apon request.
Posted on 2006-11-05 02:05:34 by Homer
I think that "Proof of Concept" is called Windows(TM) :P

Nice work though, I wonder if this has been addressed already :?:
Posted on 2006-11-05 02:47:31 by SpooK
Interesting.

DEP isn't turned on for everything, even if you have a CPU that supports it... Send over the code, I wanna have a look :)
Posted on 2006-11-05 08:51:20 by f0dder
Hi Homer,

I would like to have a look at the code as well.

Donkey
Posted on 2006-11-05 09:52:35 by donkey