flat assembler
Message board for the users of flat assembler.

Index > Windows > How to write self-modifying PE file?

Author
Thread Post new topic Reply to topic
OzzY



Joined: 19 Sep 2003
Posts: 1029
Location: Everywhere
OzzY 15 Sep 2005, 14:43
Is it possible to write a PE exe program that will modify itself in memory and write this new version of itself to another exe, for example "prog2.exe"? how to do it? maybe using CreateFileMapping API?

Thanks!
Post 15 Sep 2005, 14:43
View user's profile Send private message Reply with quote
Vasilev Vjacheslav



Joined: 11 Aug 2004
Posts: 392
Vasilev Vjacheslav 15 Sep 2005, 16:03
yes, it possible
Post 15 Sep 2005, 16:03
View user's profile Send private message Reply with quote
OzzY



Joined: 19 Sep 2003
Posts: 1029
Location: Everywhere
OzzY 15 Sep 2005, 16:40
How?
Post 15 Sep 2005, 16:40
View user's profile Send private message Reply with quote
okasvi



Joined: 18 Aug 2005
Posts: 382
Location: Finland
okasvi 15 Sep 2005, 18:15

_________________
When We Ride On Our Enemies
support reverse smileys |:
Post 15 Sep 2005, 18:15
View user's profile Send private message MSN Messenger Reply with quote
f0dder



Joined: 19 Feb 2004
Posts: 3175
Location: Denmark
f0dder 17 Sep 2005, 22:59
OzzY, it's not possible to have this working for all windows versions.

The most reliable way, if you really must do this, is to have an external app write to your .exe file.
Post 17 Sep 2005, 22:59
View user's profile Send private message Visit poster's website Reply with quote
OzzY



Joined: 19 Sep 2003
Posts: 1029
Location: Everywhere
OzzY 18 Sep 2005, 00:40
Maybe copy the program to a second .EXE file, and execute it with some command line option to write to the first .EXE?
Post 18 Sep 2005, 00:40
View user's profile Send private message Reply with quote
f0dder



Joined: 19 Feb 2004
Posts: 3175
Location: Denmark
f0dder 18 Sep 2005, 02:23
Yes, that would work. It's clumsy, though.

Another method that "works okayish" would be to inject code to some other process... but that's even more of a kludge. Forget all about the "cute" tricks that unmap the process etc.
Post 18 Sep 2005, 02:23
View user's profile Send private message Visit poster's website Reply with quote
comrade



Joined: 16 Jun 2003
Posts: 1140
Location: Russian Federation
comrade 18 Sep 2005, 15:35
u can check example called 'selfsave' on my homepage
http://comrade.ownz.com/sources/selfsave.zip
Post 18 Sep 2005, 15:35
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
Remy Vincent



Joined: 16 Sep 2005
Posts: 155
Location: France
Remy Vincent 18 Sep 2005, 17:16
Turbo GREP 5.5 Copyright (c) 1992, 1999 Inprise Corporation
Syntax: GREP [-rlcnvidzuwo] searchstring file[s] or @filelist
Options are one or more option characters preceded by "-", and optionally
followed by "+" (turn option on), or "-" (turn it off). The default is "+".
-r+ Regular expression search -l- File names only
...
...
...
-u xxx Create a copy of grep named 'xxx' with current options set as ...
...
...
...

_________________
Groups lower your IQ
Post 18 Sep 2005, 17:16
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2023, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.