3 New Notifications

New Badge Earned
Get 1K upvotes on your post
Life choices of my cat
Earned 210

Drag Images here or Browse from your computer.

Trending Posts
Sorted by Newest First
t
tesla707 29.04.20 07:51 pm

ViewPE - a new tool for hacking the PE header

Welcome the young hacker ))
Will start with a little theory, so to say why and what does it do.
Any break (whether an app or game) begins with the hacking of the executable. Professional hackers have a lot of their instruments (which naturally is not available to a General audience), which analyze PE header. What it is possible to esteem on MSDN here https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547.aspx
As you can see a lot of information. In a nutshell, is the structure of the executable file that loads with the Windows boot loader in memory, then the bootloader passes the first the instruction to the CPU and then starts to execute the command after command, which can be seen for example in the debugger OllyDbg or x64dbg.
Why the need for analysis of the PE header? Well, for example to find the entry point (OEP), which developed a love to hide. Or to find addresses and offsets tables of imports and exports to make a hook and place a new import table in the new section. And can even perform PE to remove the protekt imposed. In General without this step, the hack will not start.
All the available tools for the analysis of the PE header is, frankly, quite comfortable. Some (because the old code) can not be stretched (you have to pick your window of size 320x240), throw some 5-10 years ago and, accordingly, have nothing to do. In General, the disadvantages enough. This is what prompted me to write a light, contemporary and understandable to all editor, PE header.
Meet
Spoiler
you can download it here http://sendfile.su/1358264 (new version)
editor tested on Windows 7/8.1/10
to the editor, you need to install VC++2015 (download here https://www.microsoft.com/ru-RU/download/details.aspx?id=52685 )

The editor is at an early stage (the addition of new functions depends on my free time).
He can now:
- displays the executable file in memory;
fully parses the import table and export;
- works with both 32 bit and 64 bit files;
- supports only executable files (*.exe, and *.dll);
- displays information about the structure of the file (you can output whatnot);
- unpacks the PE header of the UPX;
- adds a new section in the PE header (for now just a dummy, and later this function will add a new import table in the new section);
- button to remove the partition and Remove the dump is not yet ready for release (outline of code there, but you need to rule);
- when trying to load a 32 bit file in a 64 bit editor (and Vice versa) will give the error message and open the correct version (all three files must be located in the same folder and not renamed).

Small instruction:
everything is simple, click Browse, select. exe or. dll, get a lot of information and activation of some buttons (depending on the structure of PE, the editor will analyze and will suggest the functions that can be applied in this file).

Attention!
In order to avoid damage of the file before editing it (adding new section) it is recommended to make a backup.

PS: as the availability of new features I will upload a new version here and describe new opportunities.
Also, please test for bugs or errors and tell me to fix it.
9 Comments
Sort by:
D
Dark_AssassinUA 29.04.20

Would you with this software on csrin or exelab

t
tesla707 29.04.20

Dark_AssassinUA
Yes, I will lay out probably the exelab when I implement some interesting ideas. There are serious guys and want to show them a fully-featured software)

R
Ripper Man 29.04.20

did not read but cheto crime smacks

t
tesla707 29.04.20

Ripper Man
Oh come on, what kind of crime
a regular viewer of the contents of the executable file with a small functionality to edit by itself and repair all the unnecessary shit from the developers :D)

R
Ripper Man 29.04.20

Oh, here is the link to rghost. go with kamentov pougarat. and no thanks

t
tesla707 29.04.20

Ripper Man
don't worry, I'll delete and perezalil new version sendfile

R
Ripper Man 29.04.20

dude are you the same Russian hacker chtoli from which all the trouble in the us?

t
tesla707 29.04.20

in the new version:
- added functionality to view all the tables available in the executable (at the moment only implemented the table pending import, import the attached is also implemented in part, but this table is very rare. And partially implemented the table DIRECTORY_BASERELOC, but for release code is not quite ready).

you can download it here http://sendfile.su/1358264 (and in the first post).

t
tesla707 29.04.20

Ripper Man
no, I'm not a hacker.
I just love to write programs, and to discover something new, it is possible to tell my hobby in my spare time.