1

I have a small exe program that runs in a system32/cmd window, and when it is finished running its small script it prompts the user to press enter to close. I want to simply have the application close once the process is finished wihtout having to enter a keystroke. How can I edit .exe file to do this?

Is there some line in HEX i can edit? What am I looking for?

7
  • 1
    Is this "press enter" the only input from the keyboard that this program requires ?
    – w s
    Mar 21 '17 at 6:28
  • yes it is (actually it says press any key, but enter is the only one that works to close it) Mar 21 '17 at 6:29
  • Then you need to find a call to function getch(), getchar() or gets(). When you opening this executable in disassembler, do you see calls to these functions ?
    – w s
    Mar 21 '17 at 6:31
  • like I sad below, im not an advanced coder. I just downloaded x32dbg and saw no references to any of those call to functions. I am a quick learner, but its a deep program. Mar 21 '17 at 6:34
  • can i send you the file? Mar 21 '17 at 6:34
3
  1. Get a decent Disassembler running (radare, IDA Pr0, BinaryNinja, x64dbg..)
  2. Find the string you are looking for in memory e.g. 'press enter ...'
  3. Look up the cross references to find the place in memory it's used for an API call
  4. Skip that part (look at later or earlier branches to patch, or just patch the bytes to jmp to the end / maybe a return will do the trick)

edit

The memory location you are looking for will do something like print the string utilizing printf and then wait for user input. In the end, it will return.

Basically you can try to alter branch conditions through binary patching or you could try to do a hard binary patch. In the later case, you can just try to patch a return-statement instead of the input-waiting-function or insert a jump.

enter image description here

NOP-ing out the highlighted call did the trick.

edit

Special regards to w s for in-chat guidance!

4
  • Step 3 and 4 things get a bit hard to understand. Im not an advanced coder. Mar 21 '17 at 6:03
  • I have Binary Ninja now, and cant seem to figure out how to find 'Press Enter' Mar 21 '17 at 6:13
  • hey i could really use your help again ! Apr 14 '17 at 5:00
  • you are always welcome to post another question - but please use a new question for it so people with similar problems may find it
    – Nordwald
    Apr 14 '17 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.