codermar
asked on
Self-Extracting Executable
I am working on a self-extracting feature for part of one of my projects.
I would like to know how to make a 'template' executable, and then how to make another application that I can use to add exe's to this template executable.
When I run the template executable, I would like to be able to load the added executable into memory and execute it.
Also, I have read about problems with this being detected as a virus from antivirus applications that scan the PE header.
How can I avoid this problem?
Also, I don't want people to be able to see the program I am extracting.
How can I segment it in memory? Or at least encrypt or compress it to make it hard for people?
I don't want to use any third party controls or utilities as I wish to integrate this into an existing project I am working on.
This is starting at 500pts, but I will add points if necessary.
Thanks.
I would like to know how to make a 'template' executable, and then how to make another application that I can use to add exe's to this template executable.
When I run the template executable, I would like to be able to load the added executable into memory and execute it.
Also, I have read about problems with this being detected as a virus from antivirus applications that scan the PE header.
How can I avoid this problem?
Also, I don't want people to be able to see the program I am extracting.
How can I segment it in memory? Or at least encrypt or compress it to make it hard for people?
I don't want to use any third party controls or utilities as I wish to integrate this into an existing project I am working on.
This is starting at 500pts, but I will add points if necessary.
Thanks.
ASKER
This is for use in a Visual Basic 6 plugin dealing with managing and securing source code, and executables - separate from Microsoft's SourceSafe.
This is something that I am fully capable of doing myself, but due to time constraints, it would be easier for me if somebody else has the functionality together already.
Thanks,
Codermar
This is something that I am fully capable of doing myself, but due to time constraints, it would be easier for me if somebody else has the functionality together already.
Thanks,
Codermar
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
The resource route described by PlanetCpp is a good one.
An alternaive is to simply append the "payload EXE" to the end of the "loader EXE" file and then append a 2-byte signature and 4-byte size to the end of that.
The loader EXE opens itself (GetModeuleFilename) and reads the last 6 bytes to verify that all is kool, then uses the length bytes to figure out where the payload EXE starts and ends. It then seeks to there and reads the original EXE writes the new file to disk (you can decrype of decompress or whatever...). Finally, it closes the new EXE and executes it.
I don't know of any way to execute such a payload EXE without first writing it to disk. It seems like it should be possible, but I've never seen the technique described.
-- Dan
An alternaive is to simply append the "payload EXE" to the end of the "loader EXE" file and then append a 2-byte signature and 4-byte size to the end of that.
The loader EXE opens itself (GetModeuleFilename) and reads the last 6 bytes to verify that all is kool, then uses the length bytes to figure out where the payload EXE starts and ends. It then seeks to there and reads the original EXE writes the new file to disk (you can decrype of decompress or whatever...). Finally, it closes the new EXE and executes it.
I don't know of any way to execute such a payload EXE without first writing it to disk. It seems like it should be possible, but I've never seen the technique described.
-- Dan
ASKER
This is usefull but I would like to clarify a couple things.
1) Part of this functionality is to protect compiled EXE's from being copied.
The problem with using a resource file is that they can be extracted and decrypted very easily.
As per Dan's response, that leaves the bare file open and exposed on the disk . .
I am looking for a way to execute the given file without allowing the user any possible way to capture the exe.
Thanks,
Marc
1) Part of this functionality is to protect compiled EXE's from being copied.
The problem with using a resource file is that they can be extracted and decrypted very easily.
As per Dan's response, that leaves the bare file open and exposed on the disk . .
I am looking for a way to execute the given file without allowing the user any possible way to capture the exe.
Thanks,
Marc
I'm getting a strange dejavu feeling. :) Marc, you asked the same question about 2 weeks ago, did you not? Maybe it's a coincidence, because last time it was about a dll instead of an exe, IIRC. What I'm confused about is this: You say "This is something that I am fully capable of doing myself". But, you ask the question: "I would like to know how to make a 'template' executable..."
I'm not trying to start a flame war or anything. I'm just confused. If seems that if you know so much about how to do it that you would have just done it by now, considering you've waited several weeks by now for an answer. There's no shame in being honest in saying "I don't know. Please help me."
I don't think it's possible, without using a bunch of undocumented system calls and/or writing to the disk.
brian
I'm not trying to start a flame war or anything. I'm just confused. If seems that if you know so much about how to do it that you would have just done it by now, considering you've waited several weeks by now for an answer. There's no shame in being honest in saying "I don't know. Please help me."
I don't think it's possible, without using a bunch of undocumented system calls and/or writing to the disk.
brian
the data has to exist at some time somewhere and especially while the exe is running. if your paranoid that they will grab the resource data then write a small encryption routine and decrypt before you write to the disk and run it, or purposely ruin the exe by changing the first few bytes and then change them back. if you're thinking they'll know to do this or figure out the encryption, or that they'll take the exe data after you fix or decrypt then theres really nothing you can do. there has to be a valid version of the exe data residing somewhere (and yes they might be able to get there) at some time.
ASKER
Excuse me, but I have never asked any smiliar question.
I am dissapointed that you would patronize me like this.
Let me explain the process that would need to be undertaken to achieve this; If somebody would like to pound out some code for me for this functionality that would be great and you would earn 500 points.
First of all, this is quite possible.
Here is what needs to be done.
1) Take this tutorial:
http://community.borland.com/article/0,1410,27979,00.html
and write c++ functions accordingly for adding data to the end of a PE executable.
2) This explains theoretically how to execute a program from directly in memory:
https://www.experts-exchange.com/questions/11625698/execute-program-direct-from-memory.html?query=load+executable+from+memory&searchType=all
NOTE: This is the simplest form of what I need to do, and it is for the most part already done for you.
If you would like to save me some time and earn some points great, if you are just here to question my ability and show your own lack of creativity by assuming this can't be done, then please make your comments elsewhere.
Thanks,
Marc
P.S. Please refer me to this other question you seem to think I asked regarding this matter.
I am dissapointed that you would patronize me like this.
Let me explain the process that would need to be undertaken to achieve this; If somebody would like to pound out some code for me for this functionality that would be great and you would earn 500 points.
First of all, this is quite possible.
Here is what needs to be done.
1) Take this tutorial:
http://community.borland.com/article/0,1410,27979,00.html
and write c++ functions accordingly for adding data to the end of a PE executable.
2) This explains theoretically how to execute a program from directly in memory:
https://www.experts-exchange.com/questions/11625698/execute-program-direct-from-memory.html?query=load+executable+from+memory&searchType=all
NOTE: This is the simplest form of what I need to do, and it is for the most part already done for you.
If you would like to save me some time and earn some points great, if you are just here to question my ability and show your own lack of creativity by assuming this can't be done, then please make your comments elsewhere.
Thanks,
Marc
P.S. Please refer me to this other question you seem to think I asked regarding this matter.
Marc, Here is the post I was referring to: https://www.experts-exchange.com/questions/20531683/Loading-dll-from-memory-image.html The problem is virtually the same, you and the other person are both very touchy, defensive, and claim that you have the knowledge to do it, but want someone else to do it for you.
If you know how to do it, great. All I've seen up to this point is theory. In essence, I agree with PlanetCpp. You may do a lot of work, come up with something that isn't even officially supported by the OS, and it only raises the bar for crackers by about 2cm.
However, If I knew how to do this, I would be selling it for $1000 or so. 500 points around here are worth $6.475. Good luck...
brian
If you know how to do it, great. All I've seen up to this point is theory. In essence, I agree with PlanetCpp. You may do a lot of work, come up with something that isn't even officially supported by the OS, and it only raises the bar for crackers by about 2cm.
However, If I knew how to do this, I would be selling it for $1000 or so. 500 points around here are worth $6.475. Good luck...
brian
Come on codermar,
>>This is the simplest form of what I need to do, and it is for the most part already done for you
Surely you can see the irony in your words!
"This is all I need to do..."
and
"...already done for you"
And if you bothered to read that thread you quoted, you know that only the broad theoretical outline was provided with a big gap in the sequence (sort of like "...then a miracle occurs..." or "Step 4: Look around and find some plutonium..." hehehe) LOL
>> This is something that I am fully capable of doing myself, but due to time constraints, it would be easier for me....
codermar,
Think of this as a great chance to show *us* how smart *you* are! Pound out some code that executes a generic EXE program from memory, without ever having been written to disk. I'll give YOU 500 points, if you can scrape together a few minutes of your precious time to make it happen.
Actually, I have a few ideas on how to make a stealth temp file, but I'm sure you can handle it without any temp file at all, so I'll not bother.
-- Dan
>>This is the simplest form of what I need to do, and it is for the most part already done for you
Surely you can see the irony in your words!
"This is all I need to do..."
and
"...already done for you"
And if you bothered to read that thread you quoted, you know that only the broad theoretical outline was provided with a big gap in the sequence (sort of like "...then a miracle occurs..." or "Step 4: Look around and find some plutonium..." hehehe) LOL
>> This is something that I am fully capable of doing myself, but due to time constraints, it would be easier for me....
codermar,
Think of this as a great chance to show *us* how smart *you* are! Pound out some code that executes a generic EXE program from memory, without ever having been written to disk. I'll give YOU 500 points, if you can scrape together a few minutes of your precious time to make it happen.
Actually, I have a few ideas on how to make a stealth temp file, but I'm sure you can handle it without any temp file at all, so I'll not bother.
-- Dan
hmm. Havent tried it, but assuming you have an exe that can extract the compressed file, pointing to the end of the exe's size as a starting point for extraction you should be able to use that as the file to extract. Just append the compressed file to the end of the extractor. A lame starting point, but should work for a simple program.
Dang, I threw down the gauntlet and codermar has skulked away.
ASKER
Dan Dan Dan . . .
Do you have anything to do with your time besides berating others?
Don't get me wrong, I love it when people actually put extensive time and effort into constructive comments like your own.
I have utmost respect for your ability as a programmer, as I am sure that you are top notch and no doubt one of the more talented people out there today.
However, you have shown yourself here to be a true jackass, and I believe that people generally get what is coming to them, so I am confident that this type of thing will come back to haunt as you journey through life.
::is endlessly entertained::
Cheers,
Marc =)
Do you have anything to do with your time besides berating others?
Don't get me wrong, I love it when people actually put extensive time and effort into constructive comments like your own.
I have utmost respect for your ability as a programmer, as I am sure that you are top notch and no doubt one of the more talented people out there today.
However, you have shown yourself here to be a true jackass, and I believe that people generally get what is coming to them, so I am confident that this type of thing will come back to haunt as you journey through life.
::is endlessly entertained::
Cheers,
Marc =)
>>I have utmost respect for your ability as a programmer,
I am truly flattered. Yet you have not addressed any of the legitimate issues that I raised. Do you care to? Or is it simpler to just insult everybody in earshot and hope that somehow that will cause them to do your work for you?
How about this:
You implement as much of FengYuan's 6-step outline as you can, and when you get stuck, come back here and post your code. I'd be glad to pitch in and help.
-- Dan
I am truly flattered. Yet you have not addressed any of the legitimate issues that I raised. Do you care to? Or is it simpler to just insult everybody in earshot and hope that somehow that will cause them to do your work for you?
How about this:
You implement as much of FengYuan's 6-step outline as you can, and when you get stuck, come back here and post your code. I'd be glad to pitch in and help.
-- Dan
In a question like this, it's important to give information about the reason for your requirement, to insure that we're not helping someone to create a virus.