1

I have a small exe program that runs in a system32/cmd window, and when it is finished running its small script it prompts the user to press enter to close. I want to simply have the application close once the process is finished wihtout having to enter a keystroke. How can I edit .exe file to do this?

Is there some line in HEX i can edit? What am I looking for?

Improve this question
7
  • 1
    Is this "press enter" the only input from the keyboard that this program requires ?
    – w s
    Mar 21, 2017 at 6:28
  • yes it is (actually it says press any key, but enter is the only one that works to close it)
    – Kalamalka Kid
    Mar 21, 2017 at 6:29
  • Then you need to find a call to function getch(), getchar() or gets(). When you opening this executable in disassembler, do you see calls to these functions ?
    – w s
    Mar 21, 2017 at 6:31
  • like I sad below, im not an advanced coder. I just downloaded x32dbg and saw no references to any of those call to functions. I am a quick learner, but its a deep program.
    – Kalamalka Kid
    Mar 21, 2017 at 6:34
  • can i send you the file?
    – Kalamalka Kid
    Mar 21, 2017 at 6:34

1 Answer 1

Reset to default
3
  1. Get a decent Disassembler running (radare, IDA Pr0, BinaryNinja, x64dbg..)
  2. Find the string you are looking for in memory e.g. 'press enter ...'
  3. Look up the cross references to find the place in memory it's used for an API call
  4. Skip that part (look at later or earlier branches to patch, or just patch the bytes to jmp to the end / maybe a return will do the trick)

edit

The memory location you are looking for will do something like print the string utilizing printf and then wait for user input. In the end, it will return.

Basically you can try to alter branch conditions through binary patching or you could try to do a hard binary patch. In the later case, you can just try to patch a return-statement instead of the input-waiting-function or insert a jump.

enter image description here

NOP-ing out the highlighted call did the trick.

edit

Special regards to w s for in-chat guidance!

Improve this answer
4
  • Step 3 and 4 things get a bit hard to understand. Im not an advanced coder.
    – Kalamalka Kid
    Mar 21, 2017 at 6:03
  • I have Binary Ninja now, and cant seem to figure out how to find 'Press Enter'
    – Kalamalka Kid
    Mar 21, 2017 at 6:13
  • hey i could really use your help again !
    – Kalamalka Kid
    Apr 14, 2017 at 5:00
  • you are always welcome to post another question - but please use a new question for it so people with similar problems may find it
    – Nordwald
    Apr 14, 2017 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.