Click here to Skip to main content
15,881,172 members
Articles / Containers / Virtual Machine

Injective Code inside Import Table

Rate me:
Please Sign up or sign in to vote.
4.95/5 (119 votes)
29 Mar 2007GPL316 min read 238.9K   10.1K   285  
An introduction to injection the code into Import Table of Portable Executable file format, which is called API redirection technique.
// Microsoft Visual C++ generated resource script.
//
#include "resource.h"

#define APSTUDIO_READONLY_SYMBOLS
/////////////////////////////////////////////////////////////////////////////
//
// Generated from the TEXTINCLUDE 2 resource.
//
#define APSTUDIO_HIDDEN_SYMBOLS
#include "windows.h"
#undef APSTUDIO_HIDDEN_SYMBOLS

/////////////////////////////////////////////////////////////////////////////
#undef APSTUDIO_READONLY_SYMBOLS

/////////////////////////////////////////////////////////////////////////////
// English (U.S.) resources

#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_ENU)
#ifdef _WIN32
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
#pragma code_page(1252)
#endif //_WIN32

/////////////////////////////////////////////////////////////////////////////
//
// Accelerator
//

IDC_PEMAKER ACCELERATORS 
BEGIN
    "/",            IDM_ABOUT,              ASCII,  ALT, NOINVERT
    "?",            IDM_ABOUT,              ASCII,  ALT, NOINVERT
END


/////////////////////////////////////////////////////////////////////////////
//
// Dialog
//

IDD_ABOUTBOX DIALOGEX 0, 0, 199, 126
STYLE DS_SYSMODAL | DS_SETFONT | DS_MODALFRAME | DS_FIXEDSYS | DS_CENTER | 
    WS_POPUP | WS_CAPTION | WS_SYSMENU
CAPTION "About..."
FONT 8, "MS Shell Dlg", 400, 0, 0x1
BEGIN
    PUSHBUTTON      "OK",IDOK,139,106,53,13
    LTEXT           "PE maker\t\tVersion 0.1",IDC_STATIC,36,12,129,9,
                    SS_NOPREFIX
    ICON            IDI_ICON,IDC_STATIC,7,7,20,20,0,WS_EX_TRANSPARENT
    GROUPBOX        "",IDC_STATIC,7,26,185,73
    LTEXT           "Website:",IDC_STATIC,17,80,30,10
    PUSHBUTTON      "http://www.ntcore.com/",IDC_WEB,87,79,92,11,BS_FLAT | 
                    NOT WS_TABSTOP
    LTEXT           "This is an exmple to work with portable executable file format.\n\nBy : Ashkbiz Danehkar\t\tJun. 01, 2006",
                    IDC_STATIC,17,38,165,34
END

IDD_MAINDLG DIALOGEX 0, 0, 297, 92
STYLE DS_SETFONT | DS_FIXEDSYS | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | 
    WS_CAPTION | WS_SYSMENU
CAPTION "[ PE maker v0.1 ]"
FONT 8, "MS Shell Dlg", 0, 0, 0x0
BEGIN
    PUSHBUTTON      "...",ID_FILE_OPEN,273,7,16,12
    EDITTEXT        IDC_FILE_OPEN,69,7,192,12,ES_AUTOHSCROLL | ES_READONLY | 
                    NOT WS_BORDER,WS_EX_STATICEDGE
    LTEXT           "Open File:",IDC_STATIC,8,7,34,12
    PUSHBUTTON      "About",ID_ABOUT,79,49,61,14
    PUSHBUTTON      "Exit",IDOK,151,49,61,14
    PUSHBUTTON      "Inject",ID_FILE_PROTECT,8,49,61,14,WS_DISABLED
    EDITTEXT        IDC_FILE_SAVE,69,22,192,12,ES_AUTOHSCROLL | ES_READONLY | 
                    WS_DISABLED | NOT WS_BORDER,WS_EX_STATICEDGE
    PUSHBUTTON      "...",ID_FILE_SAVE,273,22,16,12,WS_DISABLED
    LTEXT           "Save File:",IDC_STATIC_SAVE,8,21,34,12,WS_DISABLED
    CONTROL         "",IDC_PROGRESS1,"msctls_progress32",WS_BORDER,8,75,281,
                    10
END


#ifdef APSTUDIO_INVOKED
/////////////////////////////////////////////////////////////////////////////
//
// TEXTINCLUDE
//

1 TEXTINCLUDE 
BEGIN
    "resource.h\0"
END

2 TEXTINCLUDE 
BEGIN
    "#define APSTUDIO_HIDDEN_SYMBOLS\r\n"
    "#include ""windows.h""\r\n"
    "#undef APSTUDIO_HIDDEN_SYMBOLS\r\n"
    "\0"
END

3 TEXTINCLUDE 
BEGIN
    "\r\n"
    "\0"
END

#endif    // APSTUDIO_INVOKED


/////////////////////////////////////////////////////////////////////////////
//
// DESIGNINFO
//

#ifdef APSTUDIO_INVOKED
GUIDELINES DESIGNINFO 
BEGIN
    IDD_ABOUTBOX, DIALOG
    BEGIN
        LEFTMARGIN, 7
        RIGHTMARGIN, 192
        TOPMARGIN, 7
        BOTTOMMARGIN, 119
    END

    IDD_MAINDLG, DIALOG
    BEGIN
        LEFTMARGIN, 8
        RIGHTMARGIN, 289
        TOPMARGIN, 7
        BOTTOMMARGIN, 85
    END
END
#endif    // APSTUDIO_INVOKED


/////////////////////////////////////////////////////////////////////////////
//
// Version
//

VS_VERSION_INFO VERSIONINFO
 FILEVERSION 0,1,0,0
 PRODUCTVERSION 0,1,0,0
 FILEFLAGSMASK 0x17L
#ifdef _DEBUG
 FILEFLAGS 0x1L
#else
 FILEFLAGS 0x0L
#endif
 FILEOS 0x4L
 FILETYPE 0x1L
 FILESUBTYPE 0x0L
BEGIN
    BLOCK "StringFileInfo"
    BEGIN
        BLOCK "040904b0"
        BEGIN
            VALUE "FileDescription", "PE Maker"
            VALUE "FileVersion", "0.1.0.0"
            VALUE "InternalName", "pemaker"
            VALUE "LegalCopyright", "by Ashkbiz Danehkar."
            VALUE "OriginalFilename", "pemaker.exe"
            VALUE "ProductName", "PE maker"
            VALUE "ProductVersion", "0.10"
        END
    END
    BLOCK "VarFileInfo"
    BEGIN
        VALUE "Translation", 0x409, 1200
    END
END


/////////////////////////////////////////////////////////////////////////////
//
// RT_MANIFEST
//

IDR_RT_MANIFEST1        RT_MANIFEST             "Graphics\\XPtheme\\pemaker.exe.manifest"

/////////////////////////////////////////////////////////////////////////////
//
// Icon
//

// Icon with lowest ID value placed first to ensure application icon
// remains consistent on all systems.
IDI_ICON                ICON                    "Graphics\\icons\\PEicon.ico"

/////////////////////////////////////////////////////////////////////////////
//
// String Table
//

STRINGTABLE 
BEGIN
    IDS_APP_TITLE           "PE Maker"
    IDC_CRYPTAPI            "PE Maker"
END

#endif    // English (U.S.) resources
/////////////////////////////////////////////////////////////////////////////



#ifndef APSTUDIO_INVOKED
/////////////////////////////////////////////////////////////////////////////
//
// Generated from the TEXTINCLUDE 3 resource.
//


/////////////////////////////////////////////////////////////////////////////
#endif    // not APSTUDIO_INVOKED

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The GNU General Public License (GPLv3)


Written By
Germany Germany
Ashkbiz Danehkar studied electrical engineering and computational science at the University of Rostock, Germany, where he obtained a Master of Science in Computational Engineering in the special field of Electrical Engineering in 2007. He worked as a software and hardware developer for some private limited companies until 2005, mostly focusing on industrial automation and microcontroller programming. During 2005–2006, he worked part-time remotely as a software reverse engineer for Panda Security (Bilbao, Spain). His master's thesis in 2007 was about the development of a microcontroller-based measurement system using an embedded system equipped with a real-time operating system (RTOS) and an AVR microcontroller to monitor the neuromuscular blockade and control the anesthesia.

Comments and Discussions