Skip to content

A small tool to inject PE files import address table with an external payload DLL.

License

Notifications You must be signed in to change notification settings

oAGoulart/wrappem

Repository files navigation

WrappEm

MSBuild Platform GitHub release (latest by date) License

This is a small tool that can generate a hooked PE file which will import your custom DLL into its process. With this you can inject a payload into a process using a DLL.

I took inspiration to make this tool from Michael Chourdakis' article, but his implementation was not suited for my needs, so after some research and testing I created this tool.

The first implementation I made used the same method described in the article to create a proxy DLL, this version however modifies a DLL/Exe imports table to force Windows to import your payload DLL into the process.

If you're interested in this method you can learn more about PE Format and the Import Table (it's a lot of stuff tho, so get some coffee first). Also, consider checking my brief explanation on how this tool works here.

Usage

If you already have the binaries:

wrappem [--help] <target> <payloadDll> <dummyFunc> <outPath>

An example of how that would look like if I wanted to load myPayload.dll payload into dinput8.dll process (actually the process which imports it):

NOTES:

  1. The dummy is just a empty function but must be exported by your DLL.
  2. Also, the target file will not be edited, the output is a modified copy of it.
  3. It might not work when your target architecture doesn't match yours.
wrappem dinput8.dll myPayload.dll dummy out/dinput8.dll

Binaries

You can find pre-compiled binaries in the releases page.


Contributions

Feel free to leave your contribution here, I would really appreciate it! Also, if you have any doubts or troubles using this tool just contact me or leave an issue.

About

A small tool to inject PE files import address table with an external payload DLL.

Topics

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages