![]() |
|
#11
|
|||
|
|||
|
If you're just trying to insert some of your own code into the program to run before the program does, there's several ways of getting there. Since you're just starting out, you probably don't want to try to write a loader just yet, but there's still plenty of ways to do it.
The simplest method goes like this:
Or in short, save the processor's "state", jump away, do stuff, restore the processor's state, execute anything that you blew away, and jump back. The free space where you stick your "code cave" can come from several sources. It could be unused space in the original executable file, or you could overwrite some code that *know* will never be executed. You can also expand the size of the last section with a PE editor, per diablo2002's suggestion. Or you could add a whole new section with a PE editor and have all the empty space that you want. Of course, many programs have ways of checking if they've been modified like this, so you can't just run around modifying some programs without also removing the protection checks. But non-protected programs and simple-minded protection schemes will never know the difference. Loaders work a lot like debuggers. They load the target application as a debugged process or as a child process, and then modify the file at runtime before and/or during the execution of the target. They're more flexible and powerful than static binary modification, but they're also a more advanced topic. Loaders not only have to avoid the anti-modification checks in the target, but also have to avoid being detected. ARTeam and others have written some good tutorials on how to write loaders when you get to that point. |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| entry point to function in comobj/activex dlls | Mitchjs | General Discussion | 5 | 12-15-2005 05:45 |
| how to get the address of the entry point in an API | Warren | General Discussion | 6 | 08-30-2005 16:18 |
| Is it possable breakpoint on entry point of DLL | jadesk99 | General Discussion | 17 | 01-18-2004 12:08 |
| How to make sure this is really the Entry Point | merursinecury | General Discussion | 7 | 04-13-2003 08:20 |