what type of payload?

[makovez]

What type of payload can you add there?

[Silva97]

Hi @soermejo, the pei tool inject raw binary code on the entry point of the PE executable. It's means you need to write the payload by hand in Assembly.

Just a PoC to you see it's running:

// poc.c
#include <stdio.h>

int main(void)
{
    register long int x asm("r15");

    printf("R15: %ld\n", x);
}

; poc.asm
bits 64

mov r15, 1234567890

And compile using MinGW (I am using Linux):

x86_64-w64-mingw32-gcc poc.c -o poc.exe
nasm poc.asm -o poc.bin
pei -f poc.bin inject poc.exe

Output:

If you wanna see a full payload running, I ran msfvenom's payloads and that works.

Note: See op_inject function to learn how it's exactly inject the code.

[makovez]

Thanks