4

Like if I want to patch a function in a PE.

Now my way of doing this would be inserting a new section using lets say LordPE and then compiling anything I want to add up here and patching the original code to link up there but is there a better way?

I don't know, maybe some way to export the binary to ASM files which then I could compile back with GCC.

Because like I want to make big changes to the binary - I'm thinking of parallelizing a part of the code. Thanks.

2 Answers 2

4

To me it seems the best way to approach this, if planned changes are considerable, is to instead create a DLL (you seem to be discussing windows, although this could work in most environments).

Then, you'll only need to patch calls to your modified or new functionality functions. Either by first editing the Import Table or by dynamically loading your DLL using LoadLibrary and functions using GetProcAddress.

2
  • But how will I refer variables and functions from the original binary from my DLL?
    – rec
    Jun 12, 2017 at 19:41
  • Variables that are only used within the secret parts should be stored in the DLL, variables that are to be shared should be passed through some kind of simple API as function parameters. If creating such an API complicates the process, I would strongly recommend packing the entire executable.
    – NirIzr
    Jun 13, 2017 at 4:23
3

Exporting the file to ASM then re-compiling takes a very long time, is very complicated and should be only done if you have a decent active intelligent group. Believe me, I have done this. We reverse engineered a program back to compilable source. This project took way too long.

If your changes were minor, I would recommend codecaving. Just create a PE section jump to it and make your changes , then jump back. Tutorial on how to expand PE binary

I have done this before on large projects. And Usually a good clean approach is to use DLL injection.

You can just make your functions to over write parts of the .exe and have your functions take place. I will post a few examples as well as a youtube series which goes into decent detail on what to do.

I will let you know that these methods can be dangerous and require administrator privileges to inject into the process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.