Patch the system exe program and the exe program

Source: Internet
Author: User

Patch the system exe program and the exe program

How to patch the system program so that it can start our program when exiting.
Here, the calc.exe program of the XP system is opened.

 

To enable calc.exe to start your own program, you must use an imported function, such as shell32.dll! ShellExecuteA
Use the lordpetool dig to find that calc.exe does not have the table import function shell32.dll! ShellExecuteA

For example, there is no shell32.dll! ShellExecuteA only has ShellAboutW

 

Therefore, you must add a block and add the import table function shell32.dll to the new block! ShellExecuteA

 

For example, the. Silvana block is newly added, and the ShellExecuteA function is also added. You can use the LordPE tool to add it here.

 

Open calc.exe with ODPS, and fill in the string information in the idle location in. data (if it is filled, but it cannot be saved to exe, you can try several more locations), as shown in add at 10149e0

 

Find the exit location of calc.exe, overwrite and add the following code (directly overwrite and fill in, do not write the command to the blank location, jmp blank, jump back)

For example, write code at 010125f3.
Push 5
Push 0
Push 10149e0
Push 10149e8
Push 10149f5
Push 0
Call ShellExecuteA
Push 0
Call exit

 


All have been completed here! Don't do bad things!
CalcPro.exe is the program startup parameter apprun,

Open calc.exe and supplemented calc1.exe, CalcPro.exe

Http://pan.baidu.com/s/1kTJ4mDh

 

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.