Exe change

[drummachina]

Hello Forum!
Is there possibility to include into exe file (eg. notepad.exe) my own code so when notepad.exe runs, my program also will?

[madshi]

Of course it is possible, but there are easy and difficult ways to realize it, and madCollection doesn't offer much that can help. The easiest way would be to store the original exe into your own exe as a resource file, or just append it to the end of your exe file. Then your exe when running can extract the other exe to harddisk (e.g. to the temp folder) and execute it.

[drummachina]

Thanks for your reply, madshi.
I'm not sure we are talking about the same thing.
I would rather want to load (or maybe call) my exe from notepad.exe when notepad is run. So basicly: 'myprogram.exe' modifies notepad.exe, then quits. When modified notepad.exe is launched by user, the other program also start. Well?

[uall]

why not replacing notepad.exe with you exe and then after you exe is executed start notepad.exe ?

[drummachina]

Good point uall, but what if i want to change userinit.exe or winlogon.exe? There is need to hook into another system file, to not cause system failure.

[madshi]

Well, the trick is to make your exe appear as if it were the original system file. The original system file is attached to your exe. Then when your exe starts, you could start the original system file.

However, I'm not sure whether this kind of solution works for userinit.exe and winlogon.exe. Those are very important system files and might not like being hampered with. You might also run into problems with the system file protection.

[drummachina]

Thanks madshi.
So basicly i should take over any requests from system that are assigned to changed file, and then load the correct one. But how to do this? :/

[uall]

i think madshi is using a driver to catch new started applications

so why u dont inject a dll systemwide (then its loaded if a new exe is started) and this dll checks if its the right executable (getmodulehandle(0), getmodulefilename() and check for 'notepad.exe') and if its the correct exe then (injected) dll can start the application you want (you exe)

[drummachina]

uall can you please give me an example code for your idea?

[uall]

sorry havent madCollection installed

you need madCodeHook

http://help.madshi.net/DllInjecting.htm

inject a dll to a process with param ALL_SESSIONS = $FFFFFFED;

the dll have to look from which exe its loaded

getmodulehandle(0) / GetModuleFileNameA and checking for the exe name
msdn will help you with the functions

after that the dll can execute you program by using CreateProcess
search @ msdn

[Sirmabus]

Also take a look at the Microsoft Detours lib.
They have direct support for adding codesections and such to EXE's.

[drummachina]

It seems to be a bit complicated for me, but i'll give a try
Thank you all for reply!

[drummachina]

OK, i have few more questions...
Let's say that i injected all processes in memory with my own dll.... and then what? After reboot injection is gone? How to keep injected dll into target file? I can't figure it out ...

[uall]

install injection program as service

[drummachina]

OK, i wrote simple code for installing service:

Code: Select all

var
hSCM,hSvc:SC_HANDLE;
path:array [0..MAX_PATH] of Char;

begin
etWindowsDirectory(path,sizeof(path));
hSCM:=OpenSCManager(0,0,SC_MANAGER_CREATE_SERVICE);       
hSvc:=CreateService(hSCM,'MyService','My very own service',SERVICE_ALL_ACCESS,SERVICE_WIN32_OWN_PROCESS,SERVICE_AUTO_START,
          SERVICE_ERROR_NORMAL,pChar(path+'\system32\myinjector.exe'),0,0,0,0,0);


and service won't run. I always have this error:

Service my very own service can not be run on computer Local computer.
Error 1053: The Service did not respond to the start or control request in a
timely fashion.

User's privilages are higest in system (Administrator). I tried the same with Application Service from Delphi's menu and results are the same. What is wrong then?