PE infection (PE Patcher) example

This example looks at the PE_Patcher project. It can be found under the Chapter#2 folder of this book’s GitHub project, which is publicly available. To save space, we only extracted the highlighted code; please refer to the full project to view the full source code.

Given any executable (for example, a game installer) and specific malicious code (shellcode), we can use what we have learned so far to infect the game’s installer so that the gamer thinks they are running the game installer but executes our backdoor instead.

In this section, we will learn how to infect a normal program with shellcode in the form of a worm. The core idea is to put a malicious section in the normal program to hold the malicious code and point the program entry to the malicious code so that the infected program will trigger our malicious code directly after execution.

Figure 2.7 shows common shellcode on the internet, whose function is to pop up a...