1-byte patch to PE exe that makes it run hidden? Steve Hutchesson whered u put it? :)

[Wayne Diamond]

Sometime (i think earlier this year if not late last year) Steve Hutchesson (who else!) posted a tiny little PB source that opened an exe file, patched 1 byte somewhere in the exe file, and then when you run that exe it runs invisible -- particularly useful for console programs created with PB/CC.
I wasnt able to locate it with POFFS2 even after checking virtually all of Steve's posts!
Does anybody know where that forum thread is, or have the source for that patch?
Thanks!


------------------

[Lance Edmonds]

It was called NoCons:

http://www.powerbasic.com/support/fo...-7-000147.html

------------------
Lance
PowerBASIC Support
mailto:[email protected][email protected]</A>

[Wayne Diamond]

Ah, Steve didn't post it, Marc van den Dikkenberg did, but "Thanks to Steve Hutchesson for discovering this gem!"
No wonder I couldnt find it
Thanks a million Lance!


------------------

[Steve Hutchesson]

Wayne,

Its pretty simple stuff, if you set up the PE header in the appropriate
structure once you open the file, all you are changing is whether
the app is a console or GUI app so you just identify the correct
structure member and change the attribute.

In the structure "IMAGE_OPTIONAL_HEADER32", look for the "Subsystem"
member and change it to what you require.

Regards,

[email protected]

------------------

[Steve Hutchesson]

Wayne,

Below is all I could find in a hurry on PE manipulation, its a
research tool to split all of the PE sections into seperate files.

For reasons that escape me at the moment, I rewrote and renamed
the standard PE structures but I did leave the standard structure
names documented in the include file.

It would be easy enough for you to make a utility that opened the
EXE file and read the NT header, displayed the current "Subsystem"
attribute and laft the user with the choice of changing it.

Regards,

[email protected]

filename = peimage.inc

  ' ************************************
  ' Structures for PE file manipulation
  ' ************************************
  
  %IMAGE_SIZEOF_SECTION_HEADER      = 40
  
  ' ---------------------------------
  ' original name "IMAGE_DOS_HEADER"
  ' ---------------------------------
  TYPE IMAGE_DOS_HDR
    e_magic                       as WORD
    e_cblp                        as WORD
    e_cp                          as WORD
    e_crlc                        as WORD
    e_cparhdr                     as WORD
    e_minalloc                    as WORD
    e_maxalloc                    as WORD
    e_ss                          as WORD
    e_sp                          as WORD
    e_csum                        as WORD
    e_ip                          as WORD
    e_cs                          as WORD
    e_lfarlc                      as WORD
    e_ovno                        as WORD
    e_res(3)                      as WORD '  4 member WORD array
    e_oemid                       as WORD
    e_oeminfo                     as WORD
    e_res2(9)                     as WORD ' 10 member WORD array
    e_lfanew                      as LONG
  END TYPE
  
  ' ----------------------------------
  ' original name "IMAGE_FILE_HEADER"
  ' ----------------------------------
  TYPE IMAGE_FILE_HDR
    Machine                       as WORD
    NumberOfSections              as WORD
    TimeDateStamp                 as DWORD
    PointerToSymbolTable          as DWORD
    NumberOfSymbols               as DWORD
    SizeOfOptionalHeader          as WORD
    Characteristics               as WORD
  END TYPE
  
  ' --------------------------------------
  ' original name "IMAGE_DATA_DIRECTORY"
  ' --------------------------------------
  TYPE IMAGE_DATA_DIR
    VirtualAddress                as DWORD
    isize                         as DWORD
  END TYPE
  
  ' --------------------------------------
  ' original name "IMAGE_OPTIONAL_HEADER32"
  ' --------------------------------------
  TYPE IMAGE_OPTIONAL_HDR
    Magic                         as WORD 
    MajorLinkerVersion            as BYTE 
    MinorLinkerVersion            as BYTE 
    SizeOfCode                    as DWORD
    SizeOfInitializedData         as DWORD
    SizeOfUninitializedData       as DWORD
    AddressOfEntryPoint           as DWORD
    BaseOfCode                    as DWORD
    BaseOfData                    as DWORD
    ImageBase                     as DWORD
    SectionAlignment              as DWORD
    FileAlignment                 as DWORD
    MajorOperatingSystemVersion   as WORD 
    MinorOperatingSystemVersion   as WORD 
    MajorImageVersion             as WORD 
    MinorImageVersion             as WORD 
    MajorSubsystemVersion         as WORD 
    MinorSubsystemVersion         as WORD 
    Win32VersionValue             as DWORD
    SizeOfImage                   as DWORD
    SizeOfHeaders                 as DWORD
    CheckSum                      as DWORD
    Subsystem                     as WORD 
    DllCharacteristics            as WORD 
    SizeOfStackReserve            as DWORD
    SizeOfStackCommit             as DWORD
    SizeOfHeapReserve             as DWORD
    SizeOfHeapCommit              as DWORD
    LoaderFlags                   as DWORD
    NumberOfRvaAndSizes           as DWORD
    DataDirectory(15)             as IMAGE_DATA_DIR   ' 16 member array of structures
  END TYPE
  
  ' ---------------------------------
  ' original name "IMAGE_NT_HEADERS"
  ' ---------------------------------
  TYPE IMAGE_NT_HDR
    Signature                     as DWORD
    FileHeader                    as IMAGE_FILE_HDR
    OptionalHeader                as IMAGE_OPTIONAL_HDR
  END TYPE
  
  ' ---------------------------------------
  ' original name "IMAGE_EXPORT_DIRECTORY"
  ' ---------------------------------------
  TYPE IMAGE_EXPORT_DIR
    Characteristics               as DWORD
    TimeDateStamp                 as DWORD
    MajorVersion                  as WORD
    MinorVersion                  as WORD
    nName                         as DWORD
    nBase                         as DWORD
    NumberOfFunctions             as DWORD
    NumberOfNames                 as DWORD
    AddressOfFunctions            as DWORD
    AddressOfNames                as DWORD
    AddressOfNameOrdinals         as DWORD
  END TYPE
  
  UNION MISC
    PhysicalAddress               as DWORD
    VirtualSize                   as DWORD
  END UNION
  
  ' ---------------------------------------
  ' original name "IMAGE_SECTION_HEADER"
  ' ---------------------------------------
  TYPE IMAGE_SECTION_HDR
    Name1                         as STRING * 8
    Property                      as MISC
    VirtualAddress                as DWORD
    SizeOfRawData                 as DWORD
    PointerToRawData              as DWORD
    PointerToRelocations          as DWORD
    PointerToLinenumbers          as DWORD
    NumberOfRelocations           as WORD
    NumberOfLinenumbers           as WORD
    Characteristics               as DWORD
  END TYPE

filename = petoy.bas

  ' #########################################################################
  
      %NOPRINTDLG   = 1
  
      #COMPILE EXE
      #INCLUDE "PEIMAGE.INC"
      #INCLUDE "D:\PB6\WINAPI\WIN32API.INC"
      #INCLUDE "d:\pb6\winapi\COMDLG32.INC"
  
      GLOBAL hInstance    as DWORD
  
      GLOBAL sCount       as DWORD        ' section count
      GLOBAL nth          as DWORD        ' NT header
      GLOBAL sct          as DWORD        ' start of section headers
  
      GLOBAL mzl          as DWORD        ' MZ header length
      GLOBAL ntl          as DWORD        ' NT header length
      GLOBAL scl          as DWORD        ' SECTION header length
  
      GLOBAL FileImage$                   ' loaded file image string
      GLOBAL sta          as DWORD        ' loaded memory image start address
  
      GLOBAL dhdr         as IMAGE_DOS_HDR
      GLOBAL nthd         as IMAGE_NT_HDR
      GLOBAL shdr         as IMAGE_SECTION_HDR
      GLOBAL section()    as IMAGE_SECTION_HDR
  
      GLOBAL secdata()    as STRING       ' string buffer for section data
  
      DECLARE FUNCTION MemCopyD(ByVal src as DWORD, _
                                ByVal dst as DWORD, _
                                ByVal ln  as DWORD) as DWORD
  
      DECLARE SUB GetPEinfo(fname$)
      DECLARE SUB WriteRawSections(sname$)
      DECLARE FUNCTION GetFileName(hParent as LONG,Caption$,filepatn$) as STRING
  
  ' #########################################################################
  
  FUNCTION PbMain() as LONG
  
      fname$ = lcase$(GetFileName(0,"Select PE file","*.*"))
      If fname$ = "" Then
        EXIT FUNCTION
      End If
  
      sname$ = left$(fname$,len(fname$)-4)
      
      GetPEinfo fname$
  
      WriteRawSections sname$
  
      MsgBox "Data Written",0,"PE Toy"
  
  END FUNCTION
  
  ' #########################################################################
  
  FUNCTION MemCopyD(ByVal src as DWORD, _
                    ByVal dst as DWORD, _
                    ByVal ln  as DWORD) as DWORD
  
      #REGISTER NONE
  
        ! cld
  
        ! mov esi, src
        ! mov edi, dst
        ! mov ecx, ln
  
        ! shr ecx, 2
        ! rep movsd
  
        ! mov ecx, ln
        ! and ecx, 3
        ! rep movsb
  
      FUNCTION = 0
  
  END FUNCTION
  
  ' #########################################################################
  
  SUB GetPEinfo(fname$)
  
      LOCAL ln        as LONG     ' file length
      LOCAL src       as LONG
      LOCAL dst       as LONG
      LOCAL sln       as LONG     ' hrd len
  
      Open fname$ for binary as #1
        ln = lof(1)
        Get$ #1,ln,FileImage$
      Close #1
  
      sta = StrPtr(FileImage$)        ' file image start address
  
    ' --------------
    ' get MZ header
    ' --------------
  
      mzl = sizeof(dhdr)              ' MZ header length
  
      src = sta                       ' start of MZ header
      dst = VarPtr(dhdr)
      sln = mzl
      MemCopyD src, dst, sln
  
    ' --------------
    ' get NT header
    ' --------------
  
      ntl = sizeof(nthd)              ' NT header length
  
      nth = sta + dhdr.e_lfanew       ' start of NT header from DOS hdr
      src = nth
      dst = VarPtr(nthd)
      sln = ntl
      MemCopyD src, dst, sln
  
      sCount = nthd.FileHeader.NumberOfSections
  
    ' ---------------------------------
    ' dimension an array of structures
    ' ---------------------------------
      redim section(sCount - 1) as IMAGE_SECTION_HDR  ' array of structures
      redim secdata(sCount - 1) as STRING             ' string array for data
  
    ' ---------------------------------
    ' get section header start address
    ' ---------------------------------
      sct = sta + dhdr.e_lfanew + sln ' start of section header
  
    ' ---------------------------------------------------
    ' loop through reading each section into a structure
    ' ---------------------------------------------------
  
      scl = 40                        ' section header length
  
      rf& = 0
      While rf& < sCount
        src = sct                     ' section start address
        dst = VarPtr(section(rf&))    ' structure start address
        sln = scl                     ' structure is 40 bytes
        MemCopyD src, dst, sln        ' copy data into structure
  
        va& = section(rf&).VirtualAddress   ' loaded memory adress
        sd& = section(rf&).SizeOfRawData    ' section size
        lp& = section(rf&).PointerToRawData ' disk file address
  
      ' -----------------
      ' display sections
      ' -----------------
        ! pushad
        rva$ = "VirtualAddress(mem)"+hex$(va&,8)+chr$(13,10)+_
               "SizeOfRawData(datasize)"+hex$(sd&,8)+chr$(13,10)+_
               "PointerToRawData(disk)"+hex$(lp&,8)
  
        MsgBox rva$,0,rtrim$(section(rf&).name1)
        ! popad
      ' -----------------
  
        If sd& <> 0 Then                      ' don't write empty section
          secdata(rf&) = space$(sd&)          ' allocate the buffer
          dst          = StrPtr(secdata(rf&)) ' get its start address
  
          MemCopyD sta + lp&, dst, sd&
  
        End If
  
        ! inc rf&         ' increment loop counter
        ! add sct, 40     ' increment start address by structure length
      Wend
  
  END SUB
  
  ' #########################################################################
  
  SUB WriteRawSections(sname$)
  
      LOCAL PE_len as DWORD
      LOCAL src    as DWORD
      LOCAL dst    as DWORD
      LOCAL ln     as DWORD
  
      PE_len = dhdr.e_lfanew + ntl + (sCount * 40)
      hdr$   = left$(FileImage$,PE_len)                       ' complete PE header
  
    ' --------------------------
    ' write MZ header to string
    ' --------------------------
      mzh$   = space$(mzl)
      src    = VarPtr(dhdr)
      dst    = StrPtr(mzh$)
  
      MemCopyD src, dst, mzl
  
    ' --------------------------
    ' write NT header to string
    ' --------------------------
      nthr$  = space$(ntl)
      src    = VarPtr(nthd)
      dst    = StrPtr(nthr$)
  
      MemCopyD src, dst, ntl
  
      kill sname$+".pe"
      kill sname$+".mz"
      kill sname$+".nt"
  
      Open sname$+".pe" for Binary as #1
        Put$ #1, hdr$
      Close #1
  
      Open sname$+".mz" for Binary as #1
        Put$ #1, mzh$
      Close #1
  
      Open sname$+".nt" for Binary as #1
        Put$ #1, nthr$
      Close #1
  
      rf& = 0
  
      kill sname$+".sh?"
      kill sname$+".sd?"
  
      While rf& < sCount
        sect$ = space$(scl)
        src   = VarPtr(section(rf&))
        dst   = StrPtr(sect$)
  
        MemCopyD src, dst, scl
  
      ' ---------------------
      ' write section header
      ' ---------------------
        Open sname$+".sh"+ltrim$(str$(rf&)) for Binary as #1
          Put$ #1, sect$
        Close #1
  
      ' -------------------
      ' Write section data
      ' -------------------
        If secdata(rf&) <> "" Then
          Open sname$+".sd"+ltrim$(str$(rf&)) for Binary as #1
            Put$ #1, secdata(rf&)
          Close #1
        End If
  
        ! inc rf&
      Wend
  
  END SUB
  
  '##########################################################################
  
  FUNCTION GetFileName(hParent as LONG,Caption$,filepatn$) as STRING
  
      test$ = filepatn$
  
      rv& = OpenFileDialog(hParent, _             ' parent window
                           Caption$, _            ' caption
                           filepatn$, _           ' filename
                           "", _                  ' start directory
                           filepatn$, _           ' filename filter
                           "", _                  ' default extension
                           %OFN_PATHMUSTEXIST or _
                           %OFN_LONGNAMES or _
                           %OFN_FILEMUSTEXIST or _
                           %OFN_HIDEREADONLY)     ' flags
  
      If filepatn$ = test$ Then
        FUNCTION = ""
      Else
        FUNCTION = filepatn$
      End If
  
  END FUNCTION
  
  ' #########################################################################

------------------

[Wayne Diamond]

*drool* sensational, cheers Steve this'll keep me busy for hours


------------------