內存中創建進程

 It should be possible. But it's definitely very hard.

1) Uncompress the file into position, just as LoadLibrary would, that is expand the data according to section boundary.

2) Use VirtualProtect to set the attributes for each section according to what's in the PE header: readable/writeable/executable, etc.

3) Relocate the EXE according to the new base address. This may fail normally becasue EXE normally does not have relocation table attached in release mode. You may want to make sure your original program has a strange base address such that it will not conflict with normal EXE base address.

4) Load all imported DLL into memory, resolve all import reference, recursively.

5) Shut-down your original program as much as possible.

6) Jump to the entry point of the 'loaded' program.