From 278c9423e8902dfaf1051a07dae092b01dcdf515 Mon Sep 17 00:00:00 2001 From: SilicaAndPina Date: Fri, 6 Dec 2019 01:58:44 +1300 Subject: [PATCH] Add src --- PESubsystem/.vs/PESubsystem/v15/.suo | Bin 0 -> 39424 bytes PESubsystem/PESubsystem.sln | 22 ++++ PESubsystem/PESubsystem/App.config | 6 ++ PESubsystem/PESubsystem/PESubsystem.csproj | 52 ++++++++++ PESubsystem/PESubsystem/Program.cs | 94 ++++++++++++++++++ .../PESubsystem/Properties/AssemblyInfo.cs | 36 +++++++ 6 files changed, 210 insertions(+) create mode 100644 PESubsystem/.vs/PESubsystem/v15/.suo create mode 100644 PESubsystem/PESubsystem.sln create mode 100644 PESubsystem/PESubsystem/App.config create mode 100644 PESubsystem/PESubsystem/PESubsystem.csproj create mode 100644 PESubsystem/PESubsystem/Program.cs create mode 100644 PESubsystem/PESubsystem/Properties/AssemblyInfo.cs diff --git a/PESubsystem/.vs/PESubsystem/v15/.suo b/PESubsystem/.vs/PESubsystem/v15/.suo new file mode 100644 index 0000000000000000000000000000000000000000..1ace1b5b6580c1bd4c9170d01989aa5e2086e440 GIT binary patch literal 39424 zcmeHQ-)|#F9baEt=v@n?y>gUNuI_P^{y4ji<2cS8*PeeQcey5aX`TB)F*J_t+$HD4 zAx`dx?)p?7Dix$6AzC3JQ3)P^3ehJ7;-QoxB#LMSDgvJ1FF-sXUTBZcXJ#kfUGJ`U z?M)lIJJEM{y*o4C`ObXjJKy=v%r|epb^AYFe)aBuYL@V*c7yib^_|*B4DTa`XYCW3 z_5gnK-Fw%sU*{)2<1q|@rwA{M55c zKY1rI#EE40gUg@tR z?yvOp590nV6K>N$*%C(?9|jx%!~l-~9s(o){Qem3!+;cE1ds-d0y2Oxz(K$vz!w3B z0gnQh?g;K#Kn{=x6aeFZ3BXYR+i4PT9Pl`RX$CC>+5c}s9l3?M%qvG0(EmS%NUwcH z##H^UhyE}4U$u)He)Vky4*~Xn-}uQ}LH7R}k)NObe*y7T|5x?KJSYd)hLqzU1>6kS z3D^a=1wj5Mu<33Cununr+yU4PxD)V6z#hP-0CxdC4Y(V?bQJlY1?&af3y1>l1MCBQ z4zM5adBFXEF8~Iyzo8noRmfq)YiJj=WsG)fxO*M<&^#jCgYkz$*~bASOulu$F5xqE zM}}G8Z36EU#=0g(!lHIwjKS+#MU0G18O`y^@$UwFC69W=zlgZxZ3fDn3NS8<(Z41} zd?k}=__B^txrO_?82`^BL-sd@DeV;MAcpZOhw*C&_dLd-3EYP@; z-0zcV5Zv&e0(RC+L1={vz`%+seoG{DxO8+J84DPYzS7ZI30zXshFKbm`uUfd?j^oT2NI%Cw>NHz{ztemO z@+ZQvmgDnQ;4h$7E<)N+x3&x5Ki~R~vHp*t)vKcJS0MZAXpITcBiI^i;EGNG^&g?m zaVwx3`g3Uc3dSGue*-;k1!bAi`N6Hn-tEr$g_r~5Zr}eo52su>iBZW- z`e_>FkHXEn8(#H|a~#S`2D6l(1>OzR`ugU4d`)NusthuX@k;sY7r(Ln$zSupc@BSU z@iRi=RiFiM4C)-BUC5sTvQ_k3@#j#68p?11HQxYla?Eop#{)Y3)QP>;e-?3H&`Go6 zXMeAt1fAMlPYzvqhtR*NV|&Ga1aX!AV~1ak@>P_gD(o?C0G~fS+?j@{?Eksd_o_pTtB7BrS1S^n_LDC)7-+3G%Hm zfd9li^IjkLsro4Wo4WKkw8#{$c}V3L^z8)h6L=cJUje_L-jtHa}564Hp_MZok=0U(ifQJFf z{u{^hBY*^edQ=iH44{tc$NsD6&LLeMpnj|SF}#}u90xoOm;&(I3H?5U`xAgC0Yw01 z>L~!{HfI250gV3??q3F!0AB%o74S4*4!~LEJfH%o0yx?&0L}qaIn=$5cgu$N$hzmi zHl;l1HjGbCsG+3WEP6`UOW74-eJZSeihD2bOc{Cn!8zm`fIL(o8;2 z@zoY6?-x+(b^K8l6wnGe#6OA^vsp;CEYgpQRJ1T165K-`Qcp=dk*gBAtw@d>vh=j6 zuFItfk%PQY^QeJ`*$y&r*2?*dqP<0hQ|rg|960l*&T<7Ux(X_WQI>h|-@2&38Ym;z zaz;nlDzzSko8>Tu0)EKeXVi(vneDwSuAM-w%;H;1FS>;C(}K<(kU|?J0MsRiQCnkp zTSX}rP+HdYI=)>(Iafr9X?v%3%hHnX8OX6mb5oPF>&U*Mq=Dpce&bjpOROxFEUmGB zO6^(MF-pR+Q319(;>{u^Td0JxNNU2d}9M@utt%T@U5rVM-QN`IN$S6n~_J_jx=m;GV?a5IC!hl(eFi@hkX}k%!Z$HP#(h zA~-Wjp(LCwaeX2QV95%2VresIjSti}Qx8kKfrmoeB>ZyocvkrMESN&Gd;!?6xPIs;g zuAKHON1qUs$FZx2W7MiAdZ{(^E4^nSv+ACx>}NT}HB0JugU-FGHMvh>Mf;j3dYAf& zd)vqCIQkyxdOEuDYeyHgmZ;ud|O5g&JVeJMed*A9HY9KjxwF=d2&Ao zXYe#l9 z*w5o;i*~8?weyaOVMqBK>at(;qL!9xV@5DI zZPXMt%fX>%9kX58K5z6T&v7l9eWra6`K2f0RD2Mr6LsWs}V-~B4x?WvM)$%li`R_(JU5Y|PA zZ0ne_X%zm$=8F`+TklPB6A-!fuWncu+MatX5E0PGUB0< z4uNNBBz`1{XnX8;Q96G34U!WZ;k%KoYD6xKaXY3uP|fX)++Nkb+0*Gg%jZBFcfs-V zF>XRM{&549{BwU&vD6)Tc@ITx|1IxkAO7aAkG=Z$AHTKxhi7h^(%$~%zt29m?-%2* z9DJwp(tj`Wcr-#$%Pida`g^bMo%+G|sy}^k@4v>JV#@g5u5#T=?kQXZ4({2Z7QBHf zmiwx>-gg+@oEQ#a7Ncob#eS}&*eA#H=G<47#-1&nD(8-_Ay{|Pc*-Kin0QKJKTrZO z$Dog<#FeRX+B2{PRk4%Nj8~poG-4%(n&YUlNtR&Tn}y$pAj@_L6a-BzS6sQC%Kf-C z&AQ7rj**xrO6k4eJf7;P9b-MPw+2ZeSFY6gNxx;;g|cK(PHI6HkxL$B=cxm>1W$Q5 z=X?lXRp2@L-S`pF-i#CuCh&K4IGr5Jjpj#V>51%6EHyNej%CNj(y?SAksr&X#xnWQ z+%wl^#)}*C%`46I+H%S89IrH2*BVRLDhEp&&DvVCR4cDFuav5d%EoeSWxZLtxY*n% z*Q3q#jp||}noJChmYASc!MD{~b2CrV^IGHFT6r0HU%PfSo6e7>QrS!_F`mlCQWN=f zER#uRV~KPsnHf%uq|&3QXCP2EH;peI88Ffc14YlSna$QcT&9Rmlm-*q=L^}%a!t8#ofC5*|#W1x)1vyCCwgaxDV#E7`VBY znX3$LfmQIcZJ>SH>s{89JaPxL)K?@`e|z!rw|4&d)?MG;pKtvB&ENjdjn=LBrp}fb z?^HYan`d-)0@%V_Hzi*U%K1Nz#73I)_+7BPO|94(bYb+zi2>(y_>bSk)C+{GM2q$rFp-2Be z!v6VEZupF8#4LO1?r{NU#-po9OP&A!Jv za4W0&X2c(a{~z`xj!WI(55WHqJm5+{hhFg?MSP{z1mOS2cl}QQ|D6B^^E|vO|3AL* z8{5A%%Y6U*|BQofMZXolz5f$YRkj!S{}J{#o*?wv{yD^bLC?*KpZ(p<-;T8q-T1$u zRYZ+{cKA8^uZZ0|-u(aEgZ$_(!YlnpT=2L2?|AnA6QTbzKmLzc)&Twg1j_$i`2UIA z2YOid40!AqD6eMqSn4ELFa95+$V>U4)U$QHnft%lgMjhuwO9X-oSVR9foJ}sKMvZh z7=rNs$UT*`fqAWeBmMUBe*rc*&;B1Hdw`pBG_Ux%byN9&wDx~{`DbhuBsK*2e~M6+ z?gMzm&+*zx{zyzsSS97TE-(I{h*t$e(HtMy^yC)?Z~m9mDA_(c>c;<55_p63|HK6b z)+g%#w~m1}6E*)Zw(R@m{|Uy`P5)1`;B>B3C@%wSd3Cy*yh+_NA-w_9oMWGtD3dzHFLh@>-NzDTl$cZUOOuLSzmC{cDYt*q&xKg zBQ>i*YkwzwvAzARF|9RW)T`uk=>G?uXh1@*|34!1ALQf*DfAx{^#3Xep4Xb8{~+OE zB$)pt(|h|^y=n}KcaYG3P>}z#D0n^#{Rit`=>Id=-Gtt1E%BQRJ)=nfJ>Bi2#Xi%}e~{cXPKTDE{~(_X zDA&zG|3P-XjY9uHZoZ6o;wbbV6#5V9cUMpS>_4bnOOBS)^NCn(I5iT3|Ef%EEL~lQ zjnv8u!(*vhZ8$wf|3Ra}83+GC^m`)1f!BC0avq@kDd-=z^cMOL>hxc(={nK;zkiLI JVz2&#{txY!SpWb4 literal 0 HcmV?d00001 diff --git a/PESubsystem/PESubsystem.sln b/PESubsystem/PESubsystem.sln new file mode 100644 index 0000000..2237608 --- /dev/null +++ b/PESubsystem/PESubsystem.sln @@ -0,0 +1,22 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 15 +VisualStudioVersion = 15.0.26228.76 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PESubsystem", "PESubsystem\PESubsystem.csproj", "{3629B7C7-6FA1-4156-A996-2D0C98498C7B}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Release|Any CPU = Release|Any CPU + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {3629B7C7-6FA1-4156-A996-2D0C98498C7B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {3629B7C7-6FA1-4156-A996-2D0C98498C7B}.Debug|Any CPU.Build.0 = Debug|Any CPU + {3629B7C7-6FA1-4156-A996-2D0C98498C7B}.Release|Any CPU.ActiveCfg = Release|Any CPU + {3629B7C7-6FA1-4156-A996-2D0C98498C7B}.Release|Any CPU.Build.0 = Release|Any CPU + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/PESubsystem/PESubsystem/App.config b/PESubsystem/PESubsystem/App.config new file mode 100644 index 0000000..88fa402 --- /dev/null +++ b/PESubsystem/PESubsystem/App.config @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/PESubsystem/PESubsystem/PESubsystem.csproj b/PESubsystem/PESubsystem/PESubsystem.csproj new file mode 100644 index 0000000..ab22640 --- /dev/null +++ b/PESubsystem/PESubsystem/PESubsystem.csproj @@ -0,0 +1,52 @@ + + + + + Debug + AnyCPU + {3629B7C7-6FA1-4156-A996-2D0C98498C7B} + Exe + PESubsystem + PESubsystem + v4.5.2 + 512 + true + + + AnyCPU + true + full + false + bin\Debug\ + DEBUG;TRACE + prompt + 4 + + + AnyCPU + pdbonly + true + bin\Release\ + TRACE + prompt + 4 + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PESubsystem/PESubsystem/Program.cs b/PESubsystem/PESubsystem/Program.cs new file mode 100644 index 0000000..d61ab5a --- /dev/null +++ b/PESubsystem/PESubsystem/Program.cs @@ -0,0 +1,94 @@ +using System; +using System.Collections.Generic; +using System.IO; +using System.Linq; +using System.Text; +using System.Threading.Tasks; + +namespace PESubsystem +{ + class Program + { + + static short ReadInt16(Stream str) + { + byte[] IntBytes = new byte[2]; + str.Read(IntBytes, 0x00, 0x2); + return BitConverter.ToInt16(IntBytes, 0x0); + } + + static void WriteInt16(Stream str, short shr) + { + byte[] IntBytes = BitConverter.GetBytes(shr); + str.Write(IntBytes, 0x00, 0x2); + } + static int ReadInt32(Stream str) + { + byte[] IntBytes = new byte[4]; + str.Read(IntBytes, 0x00, 0x4); + return BitConverter.ToInt32(IntBytes,0x0); + } + static void Main(string[] args) + { + string FileName = ""; + if(args.Length >= 1) + { + FileName = args[0]; + } + else + { + Console.Write("Enter Filepath: "); + FileName = Console.ReadLine(); + } + + FileStream fs = new FileStream(FileName, FileMode.Open, FileAccess.ReadWrite); + + fs.Seek(0x3C, SeekOrigin.Begin); + int PELocation = ReadInt32(fs); + + Console.WriteLine("PE Header Location: " + PELocation.ToString()); + + fs.Seek(PELocation, SeekOrigin.Begin); + fs.Seek(0x5C, SeekOrigin.Current); + + int Subsystem = ReadInt16(fs); + + string Subsystem_Str = ""; + + switch(Subsystem) + { + case 1: + Subsystem_Str = "Win32_DRIVER"; + break; + case 2: + Subsystem_Str = "Win32_GUI"; + break; + case 3: + Subsystem_Str = "Win32_CUI"; + break; + default: + Subsystem_Str = "UNKNOWN"; + break; + } + + Console.WriteLine("PE Subsystem: " + Subsystem.ToString() + " ("+ Subsystem_Str+")"); + + short NewSubsys = 0; + + if (args.Length >= 2) + { + NewSubsys = Int16.Parse(args[1]); + } + else + { + Console.WriteLine("\nSubsystems:\n1) WIN32_DRIVER\n2) WIN32_GUI\n3) WIN32_CUI\n\nEnter new subsystem value: "); + NewSubsys = Int16.Parse(Console.ReadLine()); + } + + fs.Seek(-2, SeekOrigin.Current); + WriteInt16(fs, NewSubsys); + + Console.WriteLine("Done! Subsystem value changed to: " + NewSubsys + "\nBlessed Be!"); + } + } +} diff --git a/PESubsystem/PESubsystem/Properties/AssemblyInfo.cs b/PESubsystem/PESubsystem/Properties/AssemblyInfo.cs new file mode 100644 index 0000000..9725bb0 --- /dev/null +++ b/PESubsystem/PESubsystem/Properties/AssemblyInfo.cs @@ -0,0 +1,36 @@ +using System.Reflection; +using System.Runtime.CompilerServices; +using System.Runtime.InteropServices; + +// General Information about an assembly is controlled through the following +// set of attributes. Change these attribute values to modify the information +// associated with an assembly. +[assembly: AssemblyTitle("PESubsystem")] +[assembly: AssemblyDescription("")] +[assembly: AssemblyConfiguration("")] +[assembly: AssemblyCompany("")] +[assembly: AssemblyProduct("PESubsystem")] +[assembly: AssemblyCopyright("Copyright © 2019")] +[assembly: AssemblyTrademark("")] +[assembly: AssemblyCulture("")] + +// Setting ComVisible to false makes the types in this assembly not visible +// to COM components. If you need to access a type in this assembly from +// COM, set the ComVisible attribute to true on that type. +[assembly: ComVisible(false)] + +// The following GUID is for the ID of the typelib if this project is exposed to COM +[assembly: Guid("3629b7c7-6fa1-4156-a996-2d0c98498c7b")] + +// Version information for an assembly consists of the following four values: +// +// Major Version +// Minor Version +// Build Number +// Revision +// +// You can specify all the values or you can default the Build and Revision Numbers +// by using the '*' as shown below: +// [assembly: AssemblyVersion("1.0.*")] +[assembly: AssemblyVersion("1.0.0.0")] +[assembly: AssemblyFileVersion("1.0.0.0")]