Search code examples
winapiassemblymasmportable-executable

How to programmatically inject parameters/instructions into a pre-built portable executable

I have two executables, both manually created by me, I shall call them 1.exe and 2.exe respectively. First of all, both the executables are compiled by MSVS 2010, using the Microsoft compiler. I want to type a message into 1.exe, and I want 1.exe to inject that message into 2.exe (possibly as some sort of parameter), so when I run 2.exe after 1.exe has injected the message, 2.exe will display that message.

NOTE - this is not for illicit use, both these executables were created by me.

The big thing for me is:

  1. Where to place the message/instructions in 2.exe so they can be easily accessed by 2.exe
  2. How will 2.exe actually FIND use these parameters (message).

I fully understand that I can't simply use C++ code as injection, it must be naked assembly which can be generated/translated by the compiler at runtime (correct me if I am wrong)

Some solutions I have been thinking of:

  1. Create a standard function in 2.exe requiring parameters (eg displaying the messagebox), and simply inject these parameters (the message) into the function?
  2. Make some sort of structure in 2.exe to hold the values that 1.exe will inject, if so how? Will I need to hardcode the offset at which to put these parameters into?

Note- I don't expect a spoonfeed, I want to understand this aspect of programming proficiently, I have read up the PE file format and have solid understanding of assembly (MASM assembler syntax), and am keen to learn alot more. Thank you for your time.

Solution

  • Very few programmers ever need to do this sort of thing. You could go your entire career without it. I last did it in about 1983.

    If I remember correctly, I had 2.exe include an assembler module with something like this (I've forgotten the syntax):

    .GLOBAL TARGET
TARGET  DB 200h  ; Reserve 512 bytes

    1.exe would then open 2.exe, search the symbol table for the global symbol "TARGET", figure out where that was within the file, write the 512 bytes it wanted to, and save the file. This was for a licensing scheme.

    The comment from https://stackoverflow.com/users/422797/igor-skochinsky reminded me that I did not use the symbol table on that occasion. That was a different OS. In this case, I did scan for a string.