PHP / C ++：将值注入EXE文件 [英] PHP/C++: Inject values into EXE file
问题描述
我想即时将值注入EXE文件。
I would like to inject a value into an EXE file on the fly.
我过去处理过的一家公司给我一个EXE存根
A company I have dealt with in the past have given me a EXE "stub" which I can use PHP to inject a value into on the fly before the user downloads it.
我无法在Google上找到任何内容，因为我不知道名字这个过程中，谁能指出我正确的方向？理想情况下，它应该是C ++ / PHP，但可以灵活，或者甚至只是有关如何工作的一般过程的信息都是一个很好的开始。
I can't find anything on Google as I don't know the name of this process, can anyone point me in the right direction? Ideally it would be C++/PHP but can be flexible, or even just information of the general process of how this would work would be a great start.
他们甚至做到了用他们发送给我的EXE，我用我的证书签名，然后他们填充了文件，然后我就可以即时注入值。
They even did this with an EXE they sent me, I signed with my certificate, they then "padded" the file, and I was able to inject values on the fly.
不幸的是，他们赢了不会与我分享他们的秘密...
Unfortunately they won't share their secrets with me...
推荐答案
我可以建议几种不同的方法：
I can suggest a few different approaches:
- 在可执行文件中包含魔术字符串，例如
静态const char magic [] =魔术标记在这里’。您必须在代码的其他地方引用它，以免对其进行优化。然后，您可以从php中打开.exe并搜索魔术字符串，并在大小限制内用任意内容覆盖它。 - 如果您想插入多个值，则可以使用结构化的方法是在可执行文件中使用PE资源。有一个很好的用于解析PE资源的Python模块，也许还有一个PHP等效项。
- 更改可执行文件中的任何内容都会破坏任何代码签名。验证码哈希中排除的一件事是PE校验和（说明此处）。 PE校验和在可执行文件中处于固定偏移量，因此您可以在PHP脚本中找到该校验和并将其修补为任意内容。修补此值不会破坏authenticode签名。
- Include a magic string in your executable e.g.
static const char magic[] = "magic marker goes here"'. You will have to reference this from somewhere else in your code so it doesn't get optimised out. You can then open the .exe from php and search for the magic string and overwrite it with whatever you like, within the size limit. - If you want to insert multiple values a more structured approach is to use PE resources within the executable. There is a nice Python module for parsing PE resources, maybe there is a PHP equivalent.
- Changing anything in the executable will break any codesigning. One thing which is excluded from the authenticode hash is the PE checksum (explanation here). The PE checksum is at a fixed offset in the executable, so you could find that within your PHP script and patch it to be whatever. Patching this value will not break the authenticode signature.
这篇关于PHP / C ++：将值注入EXE文件的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
