Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
print("'{}' has no manifest. Abort!".format(mfc.name))
sys.exit(1)
if not cmd_resources_manger.has_icons:
print("'{}' has no manifest. Abort!".format(mfc.name))
sys.exit(1)
mfc_icons = mfc_resources_manger.icons
cmd_icons = cmd_resources_manger.icons
for i in range(min(len(mfc_icons), len(cmd_icons))):
mfc_resources_manger.change_icon(mfc_icons[i], cmd_icons[i])
output = os.path.join(self.tmp_dir, "mfc_test_change_icon.exe")
builder = lief.PE.Builder(mfc)
builder.build_resources(True)
builder.build()
builder.write(output)
if sys.platform.startswith("win"):
subprocess_flags = 0x8000000 # win32con.CREATE_NO_WINDOW?
p = Popen(["START", output], shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, creationflags=subprocess_flags)
time.sleep(3)
q = Popen(["taskkill", "/im", "mfc_test_change_icon.exe"], shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
stdout, _ = p.communicate()
self.logger.debug(stdout.decode("utf8"))
stdout, _ = q.communicate()
self.logger.debug(stdout.decode("utf8"))
def test_mfc_resource_builder(self):
sample_path = get_sample('PE/PE64_x86-64_binary_mfc-application.exe')
output = os.path.join(self.tmp_dir, "mfc_test_rsrc.exe")
mfc = lief.parse(sample_path)
builder = lief.PE.Builder(mfc)
builder.build_resources(True)
builder.build()
builder.write(output)
st = os.stat(output)
os.chmod(output, st.st_mode | stat.S_IEXEC)
if sys.platform.startswith("win"):
subprocess_flags = 0x8000000 # win32con.CREATE_NO_WINDOW?
p = Popen(["START", output], shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, creationflags=subprocess_flags)
time.sleep(3)
q = Popen(["taskkill", "/im", "mfc_test_rsrc.exe"], shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
stdout, _ = p.communicate()
self.logger.debug(stdout.decode("utf8"))
sample = os.path.join(sample_dir, "notepad++.exe")
output = os.path.join(sample_dir, "notepad++_imports.exe")
zip_ref = zipfile.ZipFile(sample_file, 'r')
zip_ref.extractall(self.tmp_dir)
zip_ref.close()
notepadpp = lief.parse(sample)
# Disable ASLR
notepadpp.optional_header.dll_characteristics &= ~lief.PE.DLL_CHARACTERISTICS.DYNAMIC_BASE
# Disable NX protection
notepadpp.optional_header.dll_characteristics &= ~lief.PE.DLL_CHARACTERISTICS.NX_COMPAT
builder = lief.PE.Builder(notepadpp)
builder.build_imports(True).patch_imports(True)
builder.build()
builder.write(output)
st = os.stat(output)
os.chmod(output, st.st_mode | stat.S_IEXEC)
if sys.platform.startswith("win"):
subprocess_flags = 0x8000000 # win32con.CREATE_NO_WINDOW?
p = Popen(["START", output], shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, creationflags=subprocess_flags)
time.sleep(3)
q = Popen(["taskkill", "/im", "notepad++_imports.exe"], shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
stdout, _ = p.communicate()
self.logger.debug(stdout.decode("utf8"))
code += x86.Push(0)
code += x86.Push("EDI")
code += x86.Push(0x50)
code += x86.Push("EBX")
code += x86.Push("EAX") # hConsoleOutput
code += x86.Call(call_import(imports["kernel32.dll"]["WriteFile"]))
code += x86.Mov("ESP", "EBP")
code += x86.Ret()
padded_code = code.get_code()
padded_code += x86.Nop().get_code() * (0x100 - len(padded_code))
section_text.content = tobytes(padded_code)
builder = PE.Builder(binary32)
builder.build_imports(True)
builder.build()
builder.write("pwn.exe")
print("Generated pwn.exe")
def __binary_to_bytez(self, binary, dos_stub=False, imports=False, overlay=False, relocations=False, resources=False, tls=False):
# write the file back as bytez
builder = lief.PE.Builder(binary)
builder.build_dos_stub(dos_stub) # rebuild DOS stub
builder.build_imports(imports) # rebuild IAT in another section
builder.patch_imports(imports) # patch original import table with trampolines to new import table
builder.build_overlay(overlay) # rebuild overlay
builder.build_relocations(relocations) # rebuild relocation table in another section
builder.build_resources(resources) # rebuild resources in another section
builder.build_tls(tls) # rebuilt TLS object in another section
builder.build() # perform the build process
# return bytestring
return array.array('B', builder.get_build()).tobytes()
# fixing pe optional header
pe.optional_header.addressof_entrypoint = sections["text"].virtual_address
pe.optional_header.major_operating_system_version = 0x04
pe.optional_header.minor_operating_system_version = 0x00
pe.optional_header.major_subsystem_version = 0x05
pe.optional_header.minor_subsystem_version = 0x02
pe.optional_header.major_linker_version = 0x02
pe.optional_header.minor_linker_version = 0x1e
pe.optional_header.remove(PE.DLL_CHARACTERISTICS.NX_COMPAT)
pe.optional_header.add(PE.DLL_CHARACTERISTICS.NO_SEH)
# pe.add_library("ntdll.dll")
#building exe to disk
outfile = f"{tempfile.gettempdir()}{os.path.sep:s}{basename:s}.exe"
builder = PE.Builder(pe)
builder.build_imports(True)
builder.build()
builder.write(outfile)
return outfile
binary32.optional_header.addressof_entrypoint = section_text.virtual_address
kernel32 = binary32.add_library("kernel32.dll")
kernel32.add_entry("ExitProcess")
user32 = binary32.add_library("user32.dll")
user32.add_entry("MessageBoxA")
ExitProcess_addr = binary32.predict_function_rva("kernel32.dll", "ExitProcess")
MessageBoxA_addr = binary32.predict_function_rva("user32.dll", "MessageBoxA")
print("Address of 'ExitProcess': 0x{:06x} ".format(ExitProcess_addr))
print("Address of 'MessageBoxA': 0x{:06x} ".format(MessageBoxA_addr))
builder = PE.Builder(binary32)
builder.build_imports(True)
builder.build()
builder.write("pe_from_scratch.exe")