diff --git a/PESubsystem/.vs/PESubsystem/v15/.suo b/PESubsystem/.vs/PESubsystem/v15/.suo new file mode 100644 index 0000000..1ace1b5 Binary files /dev/null and b/PESubsystem/.vs/PESubsystem/v15/.suo differ diff --git a/PESubsystem/PESubsystem.sln b/PESubsystem/PESubsystem.sln new file mode 100644 index 0000000..2237608 --- /dev/null +++ b/PESubsystem/PESubsystem.sln @@ -0,0 +1,22 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 15 +VisualStudioVersion = 15.0.26228.76 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PESubsystem", "PESubsystem\PESubsystem.csproj", "{3629B7C7-6FA1-4156-A996-2D0C98498C7B}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Release|Any CPU = Release|Any CPU + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {3629B7C7-6FA1-4156-A996-2D0C98498C7B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {3629B7C7-6FA1-4156-A996-2D0C98498C7B}.Debug|Any CPU.Build.0 = Debug|Any CPU + {3629B7C7-6FA1-4156-A996-2D0C98498C7B}.Release|Any CPU.ActiveCfg = Release|Any CPU + {3629B7C7-6FA1-4156-A996-2D0C98498C7B}.Release|Any CPU.Build.0 = Release|Any CPU + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/PESubsystem/PESubsystem/App.config b/PESubsystem/PESubsystem/App.config new file mode 100644 index 0000000..88fa402 --- /dev/null +++ b/PESubsystem/PESubsystem/App.config @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/PESubsystem/PESubsystem/PESubsystem.csproj b/PESubsystem/PESubsystem/PESubsystem.csproj new file mode 100644 index 0000000..ab22640 --- /dev/null +++ b/PESubsystem/PESubsystem/PESubsystem.csproj @@ -0,0 +1,52 @@ + + + + + Debug + AnyCPU + {3629B7C7-6FA1-4156-A996-2D0C98498C7B} + Exe + PESubsystem + PESubsystem + v4.5.2 + 512 + true + + + AnyCPU + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + + + AnyCPU + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PESubsystem/PESubsystem/Program.cs b/PESubsystem/PESubsystem/Program.cs new file mode 100644 index 0000000..d61ab5a --- /dev/null +++ b/PESubsystem/PESubsystem/Program.cs @@ -0,0 +1,94 @@ +using System; +using System.Collections.Generic; +using System.IO; +using System.Linq; +using System.Text; +using System.Threading.Tasks; + +namespace PESubsystem +{ + class Program + { + + static short ReadInt16(Stream str) + { + byte[] IntBytes = new byte[2]; + str.Read(IntBytes, 0x00, 0x2); + return BitConverter.ToInt16(IntBytes, 0x0); + } + + static void WriteInt16(Stream str, short shr) + { + byte[] IntBytes = BitConverter.GetBytes(shr); + str.Write(IntBytes, 0x00, 0x2); + } + static int ReadInt32(Stream str) + { + byte[] IntBytes = new byte[4]; + str.Read(IntBytes, 0x00, 0x4); + return BitConverter.ToInt32(IntBytes,0x0); + } + static void Main(string[] args) + { + string FileName = ""; + if(args.Length >= 1) + { + FileName = args[0]; + } + else + { + Console.Write("Enter Filepath: "); + FileName = Console.ReadLine(); + } + + FileStream fs = new FileStream(FileName, FileMode.Open, FileAccess.ReadWrite); + + fs.Seek(0x3C, SeekOrigin.Begin); + int PELocation = ReadInt32(fs); + + Console.WriteLine("PE Header Location: " + PELocation.ToString()); + + fs.Seek(PELocation, SeekOrigin.Begin); + fs.Seek(0x5C, SeekOrigin.Current); + + int Subsystem = ReadInt16(fs); + + string Subsystem_Str = ""; + + switch(Subsystem) + { + case 1: + Subsystem_Str = "Win32_DRIVER"; + break; + case 2: + Subsystem_Str = "Win32_GUI"; + break; + case 3: + Subsystem_Str = "Win32_CUI"; + break; + default: + Subsystem_Str = "UNKNOWN"; + break; + } + + Console.WriteLine("PE Subsystem: " + Subsystem.ToString() + " ("+ Subsystem_Str+")"); + + short NewSubsys = 0; + + if (args.Length >= 2) + { + NewSubsys = Int16.Parse(args[1]); + } + else + { + Console.WriteLine("\nSubsystems:\n1) WIN32_DRIVER\n2) WIN32_GUI\n3) WIN32_CUI\n\nEnter new subsystem value: "); + NewSubsys = Int16.Parse(Console.ReadLine()); + } + + fs.Seek(-2, SeekOrigin.Current); + WriteInt16(fs, NewSubsys); + + Console.WriteLine("Done! Subsystem value changed to: " + NewSubsys + "\nBlessed Be!"); + } + } +} diff --git a/PESubsystem/PESubsystem/Properties/AssemblyInfo.cs b/PESubsystem/PESubsystem/Properties/AssemblyInfo.cs new file mode 100644 index 0000000..9725bb0 --- /dev/null +++ b/PESubsystem/PESubsystem/Properties/AssemblyInfo.cs @@ -0,0 +1,36 @@ +using System.Reflection; +using System.Runtime.CompilerServices; +using System.Runtime.InteropServices; + +// General Information about an assembly is controlled through the following +// set of attributes. Change these attribute values to modify the information +// associated with an assembly. +[assembly: AssemblyTitle("PESubsystem")] +[assembly: AssemblyDescription("")] +[assembly: AssemblyConfiguration("")] +[assembly: AssemblyCompany("")] +[assembly: AssemblyProduct("PESubsystem")] +[assembly: AssemblyCopyright("Copyright © 2019")] +[assembly: AssemblyTrademark("")] +[assembly: AssemblyCulture("")] + +// Setting ComVisible to false makes the types in this assembly not visible +// to COM components. If you need to access a type in this assembly from +// COM, set the ComVisible attribute to true on that type. +[assembly: ComVisible(false)] + +// The following GUID is for the ID of the typelib if this project is exposed to COM +[assembly: Guid("3629b7c7-6fa1-4156-a996-2d0c98498c7b")] + +// Version information for an assembly consists of the following four values: +// +// Major Version +// Minor Version +// Build Number +// Revision +// +// You can specify all the values or you can default the Build and Revision Numbers +// by using the '*' as shown below: +// [assembly: AssemblyVersion("1.0.*")] +[assembly: AssemblyVersion("1.0.0.0")] +[assembly: AssemblyFileVersion("1.0.0.0")]