So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
closed as off-topic by peter ferrie, perror, Ian Cook, Avery3R, sudhackar Oct 18 at 10:38
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions on software development are off-topic here, but can be asked on Stack Overflow." – peter ferrie, perror, sudhackar
There are many steps to patch an executable, but here is I think the easiest one. The highlighted one is the EntryPoint, you can patch the highlighted one and redirect it to your control, in my sample, I added a new executable section but remember, you have to return the control to the original program, or else it will not run properly.
Added Section using StudPE.
As I mentioned from above, you have to return the control to the original program, so after executing the MessageBox , it will return to the original address.
As simply as possible? Spoof AddressOfEntryPoint in the file header. Reroute it to a new (or modified) section. MessageBoxA/W should be placed in your IAT if it isn't already, then just have the EP call OEP before jumping to your embedded shellcode. In your case that code would just be pushing arguments, calling import, and fixing up the stack.