So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
2 Answers
There are many steps to patch an executable, but here is I think the easiest one. The highlighted one is the EntryPoint, you can patch the highlighted one and redirect it to your control, in my sample, I added a new executable section but remember, you have to return the control to the original program, or else it will not run properly.
Original Section
Added Section using StudPE.
After patching.
As I mentioned from above, you have to return the control to the original program, so after executing the MessageBox , it will return to the original address.
-
Thanks! That was exactly what I was looking for! I have thought of just patching some instructions on the EP, but your solution is way more elegant. Will test it out at home later! Oct 11, 2019 at 11:06
-
Just a quick noob question... I have made the message box on masm and added the unlinked binary to the section, but when im patching it just appears as garbage hex... Oct 11, 2019 at 22:37
As simply as possible? Spoof AddressOfEntryPoint in the file header. Reroute it to a new (or modified) section. MessageBoxA/W should be placed in your IAT if it isn't already, then just have the EP call OEP before jumping to your embedded shellcode. In your case that code would just be pushing arguments, calling import, and fixing up the stack.
Image File Execution Optionsif you just wanted to show something when that file gets executed. By setting aDebuggerfor the executable, you can take it even a notch further and have your own executable take over as debugger for the "target".