Patching PE File - Adding data

Question

After opening a PE file with a disassembler, I know which instructions I have to patch. And if I have to add some data I can adjust the PE file structure manually so that it gets parsed correctly and executes.

Example, Replace EB 1C with E9 1C FD

Now, the question. I have to modify multiple locations and manually adjusting values is killing me. Can I do this with code.google.com/p/pefile from python, which I am assuming will help in adjusting? Or is there any other module I can use? Some sample code I can find?

Answer 1

It is not that easy or it is rather error prone if you are going to insert 3 bytes in place of 2 bytes you would be better off if you do a trampoline (jump to some other place do what you want jump back to next instruction by employing trampolining you can also save the registers

a small sample could be like

`jmp SomePlace` <---destroy old bytes and insert an unconditional jump  
NextInst:      <----|_________________________  
 ..                                           |    
SomePlace:                                    |   
"dancing with wolves"                         |  
jmp NextInst <------- this will jump back to->|  

in case you are interested in replacing two bytes with two bytes then almost all hex editors have some form of search and replace functionality

or you can write a simple script in your favorite utility

a simple windbg example script for replacing all the push XXXX 68 XXXXXX bytes to EB FE this example is a prototype you need to tweak it based on the pattern you get

.foreach /pS4 /ps 9 ( place { # 68?? 401000 l?0x20} ) {u place L1;ew place feeb;u place L1 } 

all this does is search the dis assembly for the pattern 68?? (blind search can alter unintended data use with caution) when found uses the address where it was found to replace the two bytes 68XX with EB FE it does this for all the bytes that are found in a given range in addition to this it also prints out the assembly prior to modification and after modification

# 68??  pattern search command in windbg 
401000 l?0x20  start search from 0x401000 end at 401020 
u place l1 disassemble one instruction when pattern found
ew place feeb  write word 0xfeeb at found address  
dis assemble again
loop with foreach where ps and pS are skip before and skip after bytes 

a sample output of above script

    0:000> .foreach /pS4 /ps 9 ( place { # 68?? 401000 l?0x20} ) {u place L1;ew place feeb;u place L1 } 
    msgbox!start+0x2 [msgbox.asm @ 17]:
    00401002 6800304000      push    offset msgbox!MsgCaption (00403000)
    msgbox!start+0x2 [msgbox.asm @ 17]:
    00401002 ebfe            jmp     msgbox!start+0x2 (00401002)
    msgbox!start+0x7 [msgbox.asm @ 17]:
    00401007 6819304000      push    offset msgbox!MsgBoxText (00403019)
    msgbox!start+0x7 [msgbox.asm @ 17]:
    00401007 ebfe            jmp     msgbox!start+0x7 (00401007)