- Forum
- Windows Programming
- Modifing the entry point of an exe file
Modifing the entry point of an exe file
Hi guys, i want to write a program in C++ language for modifing the entry point of an exe file to a random address. But i dont know how can i do this. Can anyone help me to write this program?
May I ask why? You know that there are quicker ways to break a binary file right?
To answer your question for the sake of academics: The Entry Point to a Common Object Format File (COFF), which is used on *nix and Windows by the way, is 16 bytes offset from the Optional Header section of the executable. Since hard coding magic addresses into your code is what we here at this site like to call "The WRONG way of doing things", let's look at how to obtain this address programmatically, shall we?
The struct that you are looking for is 'IMAGE_OPTIONAL_HEADER' and it is defined in 'WinNT.h'. Conveniently for you, this object has a data member called 'AddressOfEntryPoint' already built into it. This struct itself is a member of another struct called 'IMAGE_NT_HEADERS' which you would fill in by passing a pointer to a filemapping of your target executable to the function "ImageNtHeader()" (exposed by 'Dbghelp.h' and defined in 'Dbhhelp.lib'). If you have any questions feel free to ask.
EDIT: The entry point for an application is dependent on the subsystem that it is run on.
To answer your question for the sake of academics: The Entry Point to a Common Object Format File (COFF), which is used on *nix and Windows by the way, is 16 bytes offset from the Optional Header section of the executable. Since hard coding magic addresses into your code is what we here at this site like to call "The WRONG way of doing things", let's look at how to obtain this address programmatically, shall we?
The struct that you are looking for is 'IMAGE_OPTIONAL_HEADER' and it is defined in 'WinNT.h'. Conveniently for you, this object has a data member called 'AddressOfEntryPoint' already built into it. This struct itself is a member of another struct called 'IMAGE_NT_HEADERS' which you would fill in by passing a pointer to a filemapping of your target executable to the function "ImageNtHeader()" (exposed by 'Dbghelp.h' and defined in 'Dbhhelp.lib'). If you have any questions feel free to ask.
EDIT: The entry point for an application is dependent on the subsystem that it is run on.
Last edited on
Topic archived. No new replies allowed.