So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
There are many steps to patch an executable, but here is I think the easiest one. The highlighted one is the EntryPoint, you can patch the highlighted one and redirect it to your control, in my sample, I added a new executable section but remember, you have to return the control to the original program, or else it will not run properly.
Added Section using StudPE.
As I mentioned from above, you have to return the control to the original program, so after executing the MessageBox , it will return to the original address.
As simply as possible? Spoof AddressOfEntryPoint in the file header. Reroute it to a new (or modified) section. MessageBoxA/W should be placed in your IAT if it isn't already, then just have the EP call OEP before jumping to your embedded shellcode. In your case that code would just be pushing arguments, calling import, and fixing up the stack.