mirror of
https://github.com/tmpest127/enc_pic_str
synced 2026-06-08 17:51:05 +00:00
tmpest
59 lines
2.1 KiB
Python
59 lines
2.1 KiB
Python
import sys
|
|
import os
|
|
|
|
def patch_pe_section(stub_path, payload_path, output_path):
|
|
if not os.path.exists(stub_path) or not os.path.exists(payload_path):
|
|
print("[-] Error: Input files missing.")
|
|
sys.exit(1)
|
|
|
|
with open(stub_path, "rb") as f:
|
|
stub = bytearray(f.read())
|
|
with open(payload_path, "rb") as f:
|
|
payload = f.read()
|
|
|
|
# Verify MZ Header
|
|
if stub[:2] != b'MZ':
|
|
print("[-] Error: Stub is not a valid PE file.")
|
|
sys.exit(1)
|
|
|
|
# Get PE Header Offset
|
|
e_lfanew = int.from_bytes(stub[0x3C:0x40], "little")
|
|
|
|
# Section Table Info
|
|
num_sections = int.from_bytes(stub[e_lfanew+6:e_lfanew+8], "little")
|
|
size_of_optional_header = int.from_bytes(stub[e_lfanew+20:e_lfanew+22], "little")
|
|
section_table_offset = e_lfanew + 24 + size_of_optional_header
|
|
|
|
# Search for .text section
|
|
for i in range(num_sections):
|
|
offset = section_table_offset + (i * 40)
|
|
section_name = stub[offset:offset+8].decode('ascii').rstrip('\x00')
|
|
|
|
if section_name == ".text":
|
|
# PointerToRawData (Offset 20), SizeOfRawData (Offset 16)
|
|
raw_size = int.from_bytes(stub[offset+16:offset+20], "little")
|
|
raw_ptr = int.from_bytes(stub[offset+20:offset+24], "little")
|
|
|
|
if len(payload) > raw_size:
|
|
print(f"[-] Error: Payload ({len(payload)} bytes) is larger than .text section ({raw_size} bytes).")
|
|
print("[!] Increase the padding in minimal.s")
|
|
sys.exit(1)
|
|
|
|
# Patch the bytes
|
|
stub[raw_ptr:raw_ptr+len(payload)] = payload
|
|
|
|
with open(output_path, "wb") as f:
|
|
f.write(stub)
|
|
|
|
print(f"[+] Successfully patched {len(payload)} bytes into {section_name} at offset {hex(raw_ptr)}")
|
|
return
|
|
|
|
print("[-] Error: Could not find .text section in stub.")
|
|
sys.exit(1)
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) != 4:
|
|
print("Usage: python patcher.py <stub.exe> <payload.bin> <output.exe>")
|
|
sys.exit(1)
|
|
patch_pe_section(sys.argv[1], sys.argv[2], sys.argv[3])
|