|
| 1 | +#!/usr/bin/env python3 |
| 2 | + |
| 3 | +import sys |
| 4 | +import struct |
| 5 | + |
| 6 | +if len(sys.argv) < 3: |
| 7 | + print("XTChain ExeTool for modifying PE/COFF image subsystem\nNot sufficient parametrs. '[PE/COFF Image File]' '[SubSystem]'") |
| 8 | + sys.exit(1) |
| 9 | + |
| 10 | +ImageFile = sys.argv[1] |
| 11 | +Subsystem = sys.argv[2].upper() |
| 12 | + |
| 13 | +# Set proper subsystem |
| 14 | +if Subsystem == "UNKNOWN": |
| 15 | + ImageSubsystem = 0x00 |
| 16 | +elif Subsystem == "NT_NATIVE": |
| 17 | + ImageSubsystem = 0x01 |
| 18 | +elif Subsystem == "WINDOWS_GUI": |
| 19 | + ImageSubsystem = 0x02 |
| 20 | +elif Subsystem == "WINDOWS_CLI": |
| 21 | + ImageSubsystem = 0x03 |
| 22 | +elif Subsystem == "WINDOWS_CE_OLD": |
| 23 | + ImageSubsystem = 0x04 |
| 24 | +elif Subsystem == "OS2_CUI": |
| 25 | + ImageSubsystem = 0x05 |
| 26 | +elif Subsystem == "POSIX_CUI": |
| 27 | + ImageSubsystem = 0x07 |
| 28 | +elif Subsystem == "NATIVE_WINDOWS": |
| 29 | + ImageSubsystem = 0x08 |
| 30 | +elif Subsystem == "WINDOWS_CE_GUI": |
| 31 | + ImageSubsystem = 0x09 |
| 32 | +elif Subsystem == "EFI_APPLICATION": |
| 33 | + ImageSubsystem = 0x0A |
| 34 | +elif Subsystem == "EFI_BOOT_SERVICE_DRIVER": |
| 35 | + ImageSubsystem = 0x0B |
| 36 | +elif Subsystem == "EFI_RUNTIME_DRIVER": |
| 37 | + ImageSubsystem = 0x0C |
| 38 | +elif Subsystem == "EFI_ROM": |
| 39 | + ImageSubsystem = 0x0D |
| 40 | +elif Subsystem == "XBOX": |
| 41 | + ImageSubsystem = 0x0E |
| 42 | +elif Subsystem == "WINDOWS_BOOT_APPLICATION": |
| 43 | + ImageSubsystem = 0x10 |
| 44 | +elif Subsystem == "XT_NATIVE_KERNEL": |
| 45 | + ImageSubsystem = 0x14 |
| 46 | +elif Subsystem == "XT_NATIVE_APPLICATION": |
| 47 | + ImageSubsystem = 0x15 |
| 48 | +elif Subsystem == "XT_NATIVE_DRIVER": |
| 49 | + ImageSubsystem = 0x16 |
| 50 | +elif Subsystem == "XT_DYNAMIC_LIBRARY": |
| 51 | + ImageSubsystem = 0x17 |
| 52 | +elif Subsystem == "XT_APPLICATION_CLI": |
| 53 | + ImageSubsystem = 0x18 |
| 54 | +elif Subsystem == "XT_APPLICATION_GDI": |
| 55 | + ImageSubsystem = 0x19 |
| 56 | +else: |
| 57 | + print("Invalid subsystem privided") |
| 58 | + exit(2) |
| 59 | + |
| 60 | +# Open PE/COFF image file |
| 61 | +PeImage = open(sys.argv[1], "r+b") |
| 62 | + |
| 63 | +# Get PE header |
| 64 | +PeImage.seek(0x3C) |
| 65 | +(PeHeader,)=struct.unpack("H", PeImage.read(2)) |
| 66 | + |
| 67 | +# Get PE signature |
| 68 | +PeImage.seek(PeHeader) |
| 69 | +(PeSignature,)=struct.unpack("I", PeImage.read(4)) |
| 70 | +if PeSignature != 0x4550: |
| 71 | + print("Invalid or corrupted PE header") |
| 72 | + |
| 73 | +# Set new image subsystem |
| 74 | +PeImage.seek(PeHeader + 0x5C) |
| 75 | +print("Setting subsystem to " + str(ImageSubsystem)) |
| 76 | +PeImage.write(struct.pack("H", ImageSubsystem)) |
| 77 | + |
| 78 | +# Close PE/COFF image file |
| 79 | +PeImage.close() |
0 commit comments