So what I want to do basically is what BDFproxy does on the go, I want to modify a file (on the disk) to embed another PE in it and have both working, it does not matter if they work concurrently or when the main program finishes the embedded program works I just want to embed them in any way possible and if the Metasploit framework (peinjector post exploitation module) and BDFproxy can do that it is not impossible

I tried to write a python script to try and do that however when I run the outputted file it says this app cannot run on your pc here is the script:

import pefile

def embed_pe(main_exe_path, embedded_exe_path):
    # Load the main executable
    main_pe = pefile.PE(main_exe_path)

    # Load the embedded executable
    embedded_pe = pefile.PE(embedded_exe_path)

    # Create a new section in the main executable for the embedded executable
    name = ".embedded"
    virtual_size = len(embedded_pe.__data__)
    raw_size = virtual_size
    characteristics = 0xE0000020 # READ | WRITE | EXECUTE | CODE

    # Calculate the virtual offset and raw offset
    number_of_section = main_pe.FILE_HEADER.NumberOfSections
    last_section = number_of_section - 1
    virtual_offset = main_pe.sections[last_section].VirtualAddress + main_pe.sections[last_section].Misc_VirtualSize
    raw_offset = main_pe.sections[last_section].PointerToRawData + main_pe.sections[last_section].SizeOfRawData

    # Create a new section header
    new_section_header = pefile.SectionStructure(main_pe.__IMAGE_SECTION_HEADER_format__, pe=main_pe)
    new_section_header.Name = name.encode()
    new_section_header.Misc_VirtualSize = virtual_size
    new_section_header.VirtualSize = virtual_size
    new_section_header.SizeOfRawData = raw_size
    new_section_header.PointerToRawData = raw_offset
    new_section_header.VirtualAddress = virtual_offset
    new_section_header.Characteristics = characteristics

    # Add the new section header to the list of sections

    # Modify the main headers
    main_pe.FILE_HEADER.NumberOfSections += 1
    main_pe.OPTIONAL_HEADER.SizeOfImage += raw_size
    main_pe.OPTIONAL_HEADER.AddressOfEntryPoint = virtual_offset

    # Embed the embedded executable into the new section
    main_pe.__data__ = main_pe.__data__[:raw_offset] + embedded_pe.__data__ + main_pe.__data__[raw_offset:]

    # Save the modified main executable

# Usage
embed_pe("cygwin.exe", "message.exe")

So what is the way to achieve my goal and if there is what am I doing wrong in my Python script

  • those two programs are not merging two PE files into a single one. rather, they take a single PE file and inject some custom shellcode into it.
    – ynwarcs
    Commented Feb 2 at 20:42
  • @ynwarcs Okay and how is this done? Commented Feb 2 at 20:45
  • there are different methods. in general, it goes like this -> a new section is added to the executable (like in your code) or a codecave is found. then the shellcode is written to the section or the codecave. then the code of the original executable is patched (usually in the entry point function or some other generic place) so that it jumps into the injected shellcode.
    – ynwarcs
    Commented Feb 2 at 20:50


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.