-1

So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!

closed as off-topic by peter ferrie, perror, Ian Cook, Avery3R, sudhackar Oct 18 at 10:38

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on software development are off-topic here, but can be asked on Stack Overflow." – peter ferrie, perror, sudhackar
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Hi and welcome to RE.SE. It's not quite clear what the purpose is. And yeah, that matters. Because the least invasive method would be not to patch it at all and instead abuse Image File Execution Options if you just wanted to show something when that file gets executed. By setting a Debugger for the executable, you can take it even a notch further and have your own executable take over as debugger for the "target". – 0xC0000022L Oct 11 at 8:42
  • Had no idea that was even a thing lol. The purpose is just to show a message box, really. I have no interest in infecting someone – Bloco Perfeito Oct 11 at 11:08
  • but is it important to you that it happens from within that executable or does it do to "inject" the code at or before runtime? – 0xC0000022L Oct 11 at 12:21
2

There are many steps to patch an executable, but here is I think the easiest one. The highlighted one is the EntryPoint, you can patch the highlighted one and redirect it to your control, in my sample, I added a new executable section but remember, you have to return the control to the original program, or else it will not run properly.

enter image description here

Original Section

enter image description here

Added Section using StudPE.

enter image description here

After patching.

enter image description here

As I mentioned from above, you have to return the control to the original program, so after executing the MessageBox , it will return to the original address.

enter image description here

  • Thanks! That was exactly what I was looking for! I have thought of just patching some instructions on the EP, but your solution is way more elegant. Will test it out at home later! – Bloco Perfeito Oct 11 at 11:06
  • Just a quick noob question... I have made the message box on masm and added the unlinked binary to the section, but when im patching it just appears as garbage hex... – Bloco Perfeito Oct 11 at 22:37
0

As simply as possible? Spoof AddressOfEntryPoint in the file header. Reroute it to a new (or modified) section. MessageBoxA/W should be placed in your IAT if it isn't already, then just have the EP call OEP before jumping to your embedded shellcode. In your case that code would just be pushing arguments, calling import, and fixing up the stack.

Not the answer you're looking for? Browse other questions tagged or ask your own question.