Directly in the memory to run the PE
no vote
Using PE technology, Hook technology program to load PE file is loaded into memory and run. When programs running in memory, such as ARP. Will quit after the EXE is executed, the result is the ExitProcess is called, it will be the primary process ends, it is clear that we do not want that.
Approaches: HOOK ExitProcess. Issues, to many console programs MS, exit out of all of them are called, so if the HOOK ExitProcess, that both of us time in memory to run ARP. After the EXE will deadlock. So for this type of program is concerned, no h
OOK ExitProcess, can HOOK MSVCRT!exit. LOADER to load an EXE file, EXE file's address i