Printable View
Hi folks, new guy around.Can anyone help me please?
How can i alter a program's source code so it features or not whatever i choose?Is it possible to make a program install itself without any wizard,instantly upon download? Can i make an exe file identical to a file of another extension?Can i change the texts that appear on a program's window?I run windows by the way.
I would really appreciate some help on those...Thanx!!!
Maybe its just me but your first post seems strangely almost exactly like what a hacker would want to know. Why would u even want a program to run instantly without an installer unless u wanted someone to have something on their system they didnt know about? Check the AO FAQ buddy.Quote:
Originally posted here by miag01
Hi folks, new guy around.Can anyone help me please?
How can i alter a program's source code so it features or not whatever i choose?Is it possible to make a program install itself without any wizard,instantly upon download?
Hi
Sure you can do all of this and much more :)
Question by example: alter a program's source code not to feature a password check.
Simply change with a hex-editor 0F84 (jn) with 0F85 (jnz). There is only
one small problem: which one of these thousands of jumps to change ...
Question: make a program install itself without any wizard?
Make sure that your self-developed program consists of one exe-only.
The program then runs once you double-clicked it without any installation!
Hence, it actually has "installed itself".
Question: Can i make an exe file identical to a file of another extension?
Rename startme.exe to startme.txt -> You now are able to open the exe with notepad!
Question: Can i change the texts that appear on a program's window?
Yep. Once you have opened startme.txt with notepad, you can alter the text
shown in program's window.
On a more serious note: I really love the ability (.NET, ...) to sign my libraries
with my digital certificate. DLLs now cannot be easily substituted anymore!
Cheers :)
Hmmmm,
Pretty much as sec_ware has said. You need a programming editor, a compiler and knowledge of the programming language. I would also recommend a debugger.
I am not sure what you mean by that. Do you mean "install", or do you mean "run". There are lots of programs that run, but do not install (permanently) themselves. The general purposes of a "wizard" are:Quote:
Is it possible to make a program install itself without any wizard,instantly upon download?
1. Obtain user interaction as to preferences, settings, acceptance of the EULA etc.
2. Confirm that the installation was successful or not.
3. Clean up temporary files etc.
4. Allow for uninstallation.
5. Show the user progress, so they don't get impatient and kill it.
............... No, it will still be an .exe and will look nothing like a .jpg, for example. Changing the name does not change the file's fundamental characteristics.Quote:
Can i make an exe file identical to a file of another extension?
To prove this take a file such as picture.jpg and remame it to picture.exe then double click on it.
:)
Ahem...
May I interfere in the matter???
Well I would like to say something to you guys:
@ The Texan : Well ... excatly speraking you might have called him a CRACKER at once...he is asking all such questions..like cracking programs and seems like he is intersted in trojaning some of his friends prpbably. I feel pity and sad when I see HACKERS being pointed as COMPUTER CRIMINALS...which they are not. Please use the right word.
@ nihil : I think you are right to the point when you ask Install or RUN. On my part I think that it might be INSTALL...he is trying to figure out how to alter a program on a rempte computer (or add another one at startup) so that he is able to communicate thru the backdorr as and when he wishes to do....and that surely will need an INSTALL.
And by his question of making a program identical to some other file of other extension....I think that pretty much resembles the question of rock_bill who asked how do non-exe files infect the PC...is he the same person??? And I think that nihil is right.
@ sec_ware : can you explain me that what do you mean when you say "yes you can open a program in notepad by renaming it to a TXT file and opening it. I think this is an answer to the question like this : How do I look at the RAW executable code of a program..
By the way... it was sometime ago I was tryingf to mount a drive in Linux and failing aeverytime when I opened my "My Pictures" folder of windows and saw that there were pictures in the folder with another extension...Linux opened them calling them JPG. So I think that Linux doesnt care for extensions but for SIGNATURES??? Am I right???
Hi
jockey0109,
I guess no-one here wants to "feed this bear" too much, hence those
questions and remarks :)
It is clear that the thread starter wants to modify the registry, install a service
and/or register a module (to use a "generalised" wording) in such a way that "his"
program (or backdoor, as you have pointed out) will be executed at restart or even
live on the running system without user interaction. Certainly, this is possible.
Now, I have choosen this paraphrase to avoid a discussion about "install" or "run" :)
Quote:
@ sec_ware : can you explain me that what do you mean when you say "yes you can open a program in notepad by renaming it to a TXT file and opening it. I think this is an answer to the question like this : How do I look at the RAW executable code of a program..
In the essence, an executable is a file like any other - a bunch of bytes logically being
together (physically, those bytes are distributed around the harddisk). The simplest
way to open it via notepad is by renaming the .exe to .txt. You could also just use the
"open"-command of notepad, choose "all files" and click on the .exe-file.
However, since an executable is not really a .txt-file, you will mostly have "garbage".
Still, the form-ressources are plain text, hence _could_ be modified (however, you have to be
very careful by doing so).
If you want to "modify" an executable, you should use appropriate tools, not notepad, but
a hex-editor in its simplest form, or a disassembler/debugger for further analysis.
Cheers
Dear sec_ware,
I already know whatever you said. However thanks for repeating it for me.
Now my point was not to explain me how to open an EXE file in notepad...I knew this simple technique. What I wanted to convey to you...was that perhaps you had misunderstood his question. As far as I think, what he is trying to ask is HOW can he make a file which is actually an EXE with another extension but still is able to be executed without user interference on the file.
Anyway your answers are satisfying.
PEACE
Thanks.
Hmmm,
Well AFAIK that would be pretty difficult, as you would generally have to call or open a program to run it.Quote:
As far as I think, what he is trying to ask is HOW can he make a file which is actually an EXE with another extension but still is able to be executed without user interference on the file.
If I were to send you something malicious over the network, why should I bother to disguise it as something else? It would arrive and run, and you wouldn't even see it?
The concept is pretty old, as I can recall the Word Macro POC virus, and many others for MS office that followed it.
More recently we have seen embedded executables. As long as there is a suitable association set up on the target machine, it will work, provided that the user enables it.
The reason I questioned "run" as opposed to "install" is that we have seen malware that attacks over a network, and immediately runs. In so doing, it downloads and installs the payload, which may well be polymorphic and encrypted. The dropper is then deleted to avoid detection ;)
None of that would require user intervention, so there would be no need to disguise the true extension of the program.
Obviously there are a number of counter measures such as only allowing users to run authorised applications. Sandboxes and blocking executables from coming or running over the network. Preventing users from running installation programs, and protecting the registry and startup.
I didnt mean to jump to any conclusions and say automatically this guy/girl is doing this for bad purposes... I was just voicing what I thought the wording of his/her question sounded like too me.
Thanks nihil for ********ing.
@The Texan : yeah I agree. he might be asking that for good purpose too...but the language and soo many questions at once usually dont point towards suchj a good idea. anyway its ok.
Hey Hey,
This is actually quite simple to do.. however it won't get you overly far..Quote:
As far as I think, what he is trying to ask is HOW can he make a file which is actually an EXE with another extension but still is able to be executed without user interference on the file.
Command Prompt:
While you can't see it... both notepad.txt and start notepad.txt will cause notepad to launch... However, if you go to run and type notepad.txt it will open the notepad binary inside notepad.Code:Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\Administrator>cd \windows
C:\WINDOWS>copy notepad.exe notepad.txt
1 file(s) copied.
C:\WINDOWS>notepad.txt
C:\WINDOWS>start notepad.txt
Just because you've changed the extension of a file (something that you have to register anyways (Windows is the only operating system in high use that relies on file extensions)) doesn't mean you've changed the file type...
Example:
I've changed the extension but the file is still the same type... That's why it works for you at the command prompt and not from run... WIth run it first looks to the file types associations and see "oh... .txt I open that with notepad"..Code:htregz@desktop:~/.wine/drive_c/windows> file notepad.exe
notepad.exe: PE executable for MS Windows (GUI) Intel 80386
htregz@desktop:~/.wine/drive_c/windows> file notepad.txt
notepad.txt: PE executable for MS Windows (GUI) Intel 80386
Peace,
HT
You must spread your AntiPoints around before giving it to HTRegz again.
Not Again !!
That was excellent !! Thanks for the info !!
changeing the 'exe' etention to 'gif' will still run the program from the cmd prompt
U:\>rename wget.exe wget.gif
U:\>wget.gif
wget: missing URL
Usage: wget [OPTION]... [URL]...
Try `wget --help' for more options.
U:\>
therefore the saying "beware of geeks bearing gifs"
Thanx!!Appreciate your helping e-hands!!!!!!!
What programming editors and compilers would you recommend me, and how do i find out what language is used for a specific program?Can a program be written in multiple languages?How do i know what languages are read by an specific system?How can i access the windows registry?What language does it "speak"?Where can i find out what is doable on the registry?
Can anyone help me on those?
E-cheers!
Try this: http://www.google.com/
You need to learn about programs, files and operating systems before you do anything else.
Ones specifically designed for the programming language you have chosen.Quote:
What programming editors and compilers would you recommend me
From its source code or from the header of its binary executable.Quote:
how do i find out what language is used for a specific program?
Yes.Quote:
Can a program be written in multiple languages?
You don't............basically all computers use binary at the lowest level. The question would be whether their operating system understood the instructions.Quote:
How do i know what languages are read by an specific system?
<start>Quote:
How can i access the windows registry?
<run>
<regedit>
It doesn't, it is basically a repository of information about the (Windows) system.Quote:
What language does it "speak"?
Check the link at the top.Quote:
Where can i find out what is doable on the registry?
:rolleyes:
Hi
miag01, you certainly know the most important step: how to ask questions :)
If you want to develop programs for Linux, try KDevelop. I used it about 2 years ago.Quote:
What programming editors and compilers would you recommend me
If you want to develop programs for Windows, there is nothing that beats the Visual Studio line,
in particular VS2005 Express[1] is free. You could also start with Dev-C++[2], if you like to
use C/C++.
In any case, nowadays, I would recommend the .NET-Environment.
It is possible, but not always 100%. Have a look at Aaron's place[3], a valuable resource.Quote:
and how do i find out what language is used for a specific program?
Certainly. It happens that libraries are written in some language likeQuote:
Can a program be written in multiple languages?
Fortran, while the main-"program" is written in c/c++. In the .NET-world,
it does not really matter either - some functions can be written in VB.NET,
others in C#, ...
In principle, any OS understands any language:Quote:
How do i know what languages are read by an specific system?
That's what compilers/linkers[4] are for: they translate the source code in some
language into a binary executable for a certain platform
(simplified: PE for windows, ELF for Linux).
Besides regedit, see[5], where I illustrate the programmatical usage ofQuote:
How can i access the windows registry?What language does it "speak"?Where can i find out what is doable on the registry? Can anyone help me on those?
the registry. In that sense, the registry does not speak a language - windows
will offer you functions (an API), which you can use.
A simple advice for your following questions (which I expect :D):
Try to research a little bit - and ask more specifically in the sense of:
"I have seen this and that - can you recommend it? Can you recommend something else?"
/edit: ...or as nihil puts it: "http://www.google.com" :D
Cheers
[1] http://msdn.microsoft.com/vstudio/express/
[2] http://www.bloodshed.net/devcpp.html
[3] http://www.exetools.com/file-analyzers.htm
[4] http://www.antionline.com/showthread...hreadid=266406 (and references therein)
[5] http://www.antionline.com/showthread...hreadid=266630
Well thanks HT. However I knew that...I already saw the effect in Linux...when i saw that some renamed JPG files were still displayed..then I came to know thst every file type has its own signature....and that certainly means that changing extension will not change the file type....however I really didnt know that the START command is going to do that!!!! Thats awesome info BTW.
Hi sec_ware :hello:
Im not able to understand what are you saying.....Quote:
Yep. Once you have opened startme.txt with notepad, you can alter the text
Did you mean that if we alter that text some changes will be made in that .exe..
:what:
nihil
Well nihil I do agree with you....Quote:
No, it will still be an .exe and will look nothing like a .jpg, for example. Changing the name does not change the file's fundamental characteristics.
My Dearest jockey0109 or VK :rolleyes:
I am not that person who wants to enter thru backdoor.... Yeah this question somewhatQuote:
And by his question of making a program identical to some other file of other extension....I think that pretty much resembles the question of rock_bill who asked how do non-exe files infect the PC...is he the same person??? And I think that nihil is right.
resembles my question but thats not me..
Hey HTRegz
You did a marvellous job......
OK rock_bill, You hit me right on the head. You seem to be a genuine person. ANyway by telling that "you can alter the text of startme.txt after opening the program in notepad, he probably means that you can change the program in text mode by opening notepad".
Thanks
Thanx once again,specially to sec_ware!I intend to run viruses on a partitioned windows/linux box, so i can see them working without damaging the whole damn thing....Would this be a reliable (safe) laboratory?If i get to download a back door creating utility, would norton take it for a trojan horse,even if it didn't cause harm to my box? What does an AV exactly look for?
I promise to try Google!!!
miag : A virus is built for damaging your ystem and will do so for sure...if you donwload a virus, it will surely damamge your system no matter what you do...the only way to prevent that is "REMOVE THE VIRUS".
Norton will surely detect a backdoor creation utility as a trojan bacuse its the job of norton...it identifies most of them!!!
Your laboratory will fail....its really not safe. For doing what you want to look at, you will probabaly have to install the windows on Linux on QEMU or use those viruses upon emulation engine like Wine!!
Hi
I said this on a not so serious note, but in principle, yes, itQuote:
Im not able to understand what are you saying.....Quote:
Yep. Once you have opened startme.txt with notepad, you can alter the text
Did you mean that if we alter that text some changes will be made in that .exe..
is possible to alter the strings in an executable - as long as your
text-editing tool does not change special character like #10 and #13
etc, and as long as you do not change the length of the strings.
Notepad is thus the wrong tool, a hex-editor is more appropriate :)
Have a look at theHorse13's tutorial[1] about forensic analysis of malcode for competent answers.Quote:
partitioned windows/linux box, so i can see them working without damaging the whole damn thing....Would this be a reliable (safe) laboratory?
Have a look at [2] and [3]. A short but incomplete answer is thatQuote:
What does an AV exactly look for?
they scan for a specific sequence of bytes, called a signature.
Great! :DQuote:
I promise to try Google!!!
Cheers
[1] http://www.antionline.com/showthread...hreadid=272469
[2] http://www.bytware.com/press/scan_engine.pdf
[3] http://www.antionline.com/showthread...ighlight=bagle and http://rozinov.sfs.poly.edu/papers/b...ysis_v.1.0.pdf