So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!

  • 3
    Hi and welcome to RE.SE. It's not quite clear what the purpose is. And yeah, that matters. Because the least invasive method would be not to patch it at all and instead abuse Image File Execution Options if you just wanted to show something when that file gets executed. By setting a Debugger for the executable, you can take it even a notch further and have your own executable take over as debugger for the "target". – 0xC0000022L Oct 11 '19 at 8:42
  • Had no idea that was even a thing lol. The purpose is just to show a message box, really. I have no interest in infecting someone – Bloco Perfeito Oct 11 '19 at 11:08
  • but is it important to you that it happens from within that executable or does it do to "inject" the code at or before runtime? – 0xC0000022L Oct 11 '19 at 12:21

There are many steps to patch an executable, but here is I think the easiest one. The highlighted one is the EntryPoint, you can patch the highlighted one and redirect it to your control, in my sample, I added a new executable section but remember, you have to return the control to the original program, or else it will not run properly.

enter image description here

Original Section

enter image description here

Added Section using StudPE.

enter image description here

After patching.

enter image description here

As I mentioned from above, you have to return the control to the original program, so after executing the MessageBox , it will return to the original address.

enter image description here

| improve this answer | |
  • Thanks! That was exactly what I was looking for! I have thought of just patching some instructions on the EP, but your solution is way more elegant. Will test it out at home later! – Bloco Perfeito Oct 11 '19 at 11:06
  • Just a quick noob question... I have made the message box on masm and added the unlinked binary to the section, but when im patching it just appears as garbage hex... – Bloco Perfeito Oct 11 '19 at 22:37

As simply as possible? Spoof AddressOfEntryPoint in the file header. Reroute it to a new (or modified) section. MessageBoxA/W should be placed in your IAT if it isn't already, then just have the EP call OEP before jumping to your embedded shellcode. In your case that code would just be pushing arguments, calling import, and fixing up the stack.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.