title: Access violation reading when trying to run pe file from memory
body: <p>I took famous example of running pe executable from memory. But when I trying to run it am getting memory access violation on function WriteProcessMemory(). </p>
  
  <p>I am using the latest Visual Studio 2019 and I have Windows 10 x64 OS. In preferences in Visual Studio I select Debug and x86 build. The app that I am trying to run(simpleMessageBox.exe) is the same x86 Debug. Here is my full program:</p>
  
  <pre><code>#include &lt;iostream&gt;
  #include &lt;string&gt;
  #include &lt;fstream&gt;
  #include &lt;vector&gt;
  #include &lt;Windows.h&gt; // WinAPI header
  #include &lt;TlHelp32.h&gt; // WinAPI Process API
  
  std::vector&lt;uint8_t&gt; getFileContents(const char* filePath)
  {
      std::vector&lt;uint8_t&gt; rawData;
  
      std::ifstream stream(filePath, std::ios::in);
      rawData = std::vector&lt;uint8_t&gt;(std::istreambuf_iterator&lt;char&gt;(stream), std::istreambuf_iterator&lt;char&gt;());
  
      return rawData;
  }
  
  int RunPortableExecutable(void* Image)
  {
      IMAGE_DOS_HEADER* DOSHeader; // For NT DOS Header symbols
      IMAGE_NT_HEADERS* NtHeader; // For Nt Header objects &amp; symbols
      IMAGE_SECTION_HEADER* SectionHeader;
  
      PROCESS_INFORMATION PI;
      STARTUPINFOA SI;
  
      CONTEXT* CTX;
  
      DWORD* ImageBase; // Base address of the image
      void* pImageBase; // Point to the image base
  
      int count;
      char CurrentFilePath[1024];
  
      DOSHeader = PIMAGE_DOS_HEADER(Image); // Initialize variable
      NtHeader = (PIMAGE_NT_HEADERS)((char*)DOSHeader + DOSHeader-&gt;e_lfanew);
  
      GetModuleFileNameA(0, CurrentFilePath, 1024); // Path to current executable
      if (DOSHeader-&gt;e_magic == IMAGE_DOS_SIGNATURE) // Check if image is a PE file
      {
          ZeroMemory(&amp;PI, sizeof(PI)); // Null the memory
          ZeroMemory(&amp;SI, sizeof(SI)); // Null the memory
  
          if (CreateProcessA(CurrentFilePath, NULL, NULL, NULL, FALSE,
          CREATE_SUSPENDED, NULL, NULL, &amp;SI, &amp;PI)) // Create a new instance of current
             //process in suspended state, for the new image.
          {
              // Allocate memory for the context.
              CTX = LPCONTEXT(VirtualAlloc(NULL, sizeof(CTX), MEM_COMMIT, PAGE_READWRITE));
              CTX-&gt;ContextFlags = CONTEXT_FULL; // Context is allocated
  
              if (GetThreadContext(PI.hThread, LPCONTEXT(CTX))) //if context is in thread
              {
                  // Read instructions
                  ReadProcessMemory(PI.hProcess, LPCVOID(CTX-&gt;Ebx + 8), LPVOID(&amp;ImageBase), 4, 0);
  
                  pImageBase = VirtualAllocEx(PI.hProcess, LPVOID(NtHeader-&gt;OptionalHeader.ImageBase),
                  NtHeader-&gt;OptionalHeader.SizeOfImage, 0x3000, PAGE_EXECUTE_READWRITE);
  
                  // Write the image to the process
                  WriteProcessMemory(PI.hProcess, pImageBase, Image, NtHeader-&gt;OptionalHeader.SizeOfHeaders, NULL);
  
                  for (count = 0; count &lt; NtHeader-&gt;FileHeader.NumberOfSections; count++)
                  {
                      SectionHeader = PIMAGE_SECTION_HEADER(DWORD(Image) + DOSHeader-&gt;e_lfanew + 248 + (count * 40));
  
                      WriteProcessMemory(PI.hProcess, LPVOID(DWORD(pImageBase) + SectionHeader-&gt;VirtualAddress),
                      LPVOID(DWORD(Image) + SectionHeader-&gt;PointerToRawData), SectionHeader-&gt;SizeOfRawData, 0);
                  }
                  WriteProcessMemory(PI.hProcess, LPVOID(CTX-&gt;Ebx + 8), LPVOID(&amp;NtHeader-&gt;OptionalHeader.ImageBase), 4, 0);
  
                  // Move address of entry point to the eax register
                  CTX-&gt;Eax = DWORD(pImageBase) + NtHeader-&gt;OptionalHeader.AddressOfEntryPoint;
                  SetThreadContext(PI.hThread, LPCONTEXT(CTX)); // Set the context
                  ResumeThread(PI.hThread); //´Start the process/call main()
  
                  return 0; // Operation was successful.
              }
          }
      }
  }
  
  int main()
  {
      auto rawPEData = getFileContents("C:\\Users\\..\\simpleMessageBox.exe");
      auto runError = RunPortableExecutable(&amp;rawPEData[0]);
      return runError;
  }
  </code></pre>
  
  <p>Appreciate any help. Thanks in advance.</p>