GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → secrary → Infectpe

secrary / Infectpe

InfectPE - Inject custom code into PE file [This project is not maintained anymore]

Labels

reverse-engineeringmalware

Projects that are alternatives of or similar to Infectpe

Dex Oracle
A pattern based Dalvik deobfuscator which uses limited execution to improve semantic analysis
Stars: ✭ 398 (+49.62%)
Mutual labels:  malware, reverse-engineering
Pecli
CLI tool to analyze PE files
Stars: ✭ 46 (-82.71%)
Mutual labels:  malware, reverse-engineering
Domain generation algorithms
Some results of my DGA reversing efforts
Stars: ✭ 417 (+56.77%)
Mutual labels:  malware, reverse-engineering
Simpleator
Simpleator ("Simple-ator") is an innovative Windows-centric x64 user-mode application emulator that leverages several new features that were added in Windows 10 Spring Update (1803), also called "Redstone 4", with additional improvements that were made in Windows 10 October Update (1809), aka "Redstone 5".
Stars: ✭ 260 (-2.26%)
Mutual labels:  malware, reverse-engineering
Practicalmalwarelabs
Keep track of the labs from the book "Practical Malware Analysis"
Stars: ✭ 130 (-51.13%)
Mutual labels:  malware, reverse-engineering
Simplify
Android virtual machine and deobfuscator
Stars: ✭ 3,865 (+1353.01%)
Mutual labels:  malware, reverse-engineering
Anti Emulator
Android Anti-Emulator
Stars: ✭ 587 (+120.68%)
Mutual labels:  malware, reverse-engineering
Freki
🐺 Malware analysis platform
Stars: ✭ 285 (+7.14%)
Mutual labels:  malware, reverse-engineering
Awesome Hacking Resources
A collection of hacking / penetration testing resources to make you better!
Stars: ✭ 11,466 (+4210.53%)
Mutual labels:  malware, reverse-engineering
Php Malware Analysis
Deobfuscation and analysis of PHP malware captured by a WordPress honey pot
Stars: ✭ 82 (-69.17%)
Mutual labels:  malware, reverse-engineering
Pwndbg
Exploit Development and Reverse Engineering with GDB Made Easy
Stars: ✭ 4,178 (+1470.68%)
Mutual labels:  malware, reverse-engineering
Antidebugging
A collection of c++ programs that demonstrate common ways to detect the presence of an attached debugger.
Stars: ✭ 161 (-39.47%)
Mutual labels:  malware, reverse-engineering
Reverse Engineering Tutorial
A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit ARM & 64-bit ARM architectures.
Stars: ✭ 5,763 (+2066.54%)
Mutual labels:  malware, reverse-engineering
Drakvuf Sandbox
DRAKVUF Sandbox - automated hypervisor-level malware analysis system
Stars: ✭ 384 (+44.36%)
Mutual labels:  malware, reverse-engineering
Nt wrapper
A wrapper library around native windows sytem APIs
Stars: ✭ 287 (+7.89%)
Mutual labels:  malware, reverse-engineering
Lazy importer
library for importing functions from dlls in a hidden, reverse engineer unfriendly way
Stars: ✭ 544 (+104.51%)
Mutual labels:  malware, reverse-engineering
Malware Analysis Scripts
Collection of scripts for different malware analysis tasks
Stars: ✭ 61 (-77.07%)
Mutual labels:  malware, reverse-engineering
Pafish
Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do
Stars: ✭ 2,026 (+661.65%)
Mutual labels:  malware, reverse-engineering
Qiling
Qiling Advanced Binary Emulation Framework
Stars: ✭ 2,816 (+958.65%)
Mutual labels:  malware, reverse-engineering
Yobi
Yara Based Detection Engine for web browsers
Stars: ✭ 39 (-85.34%)
Mutual labels:  malware
View All Similar Projects ➔

InfectPE

Using this tool you can inject x-code/shellcode into PE file. InjectPE works only with 32-bit executable files.

Why you need InjectPE?

  • You can test your security products.
  • Use in a phishing campaign.
  • Learn how PE injection works.
  • ...and so on.

In the project, there is hardcoded x-code of MessageBoxA, you can change it.

Download

Windows x86 binary - Hardcoded MessageBoxA x-code, only for demos.

Dependencies:

vc_redist.x86 - Microsoft Visual C++ Redistributable

Usage

.\InfectPE.exe .\input.exe .\out.exe code

X-code is injected into code section, this method is more stealthy, but sometimes there is no enough space in the code section.

.\InfectPE.exe .\input.exe .\out.exe largest

X-code is injected into a section with the largest number of zeros, using this method you can inject bigger x-code. This method modifies characteristics of the section and is a bit more suspicious.

.\InfectPE.exe .\input.exe .\out.exe resize

Expand the size of code section and inject x-code. This technique, like "code" one, is less suspicious, also you can inject much bigger x-code.

.\InfectPE.exe .\input.exe .\out.exe new

Create a new section and inject x-code into it, hardcoded name of the section is ".infect"

In the patched file, ASLR and NX are disabled, for the more technical information you can analyze VS project.

Please, don't use with packed or malformed executables.

Demo

Vimeo - "code" and "largest" techniques.

Vimeo - "resize" technique.

TODO:

Add more techniques to inject x-code into PE file.

!!!

I create this project for me to learn a little bit more about PE file format.

There are no advanced techniques.

Just only for educational purposes.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].