to make a self-contained exe that extracts files and other commands

Question

I am making a filtering sniffer in C and winPCAP that starts on every boot. For this I want to make a self-contained exe file that extracts (no, not compression!) the exe and DLLs to a new folder and performs other commands (like modify startup settings) silently, without showing any window/terminal.

So

1. The single file contains an exe and DLLs.

2. When executed, it copies the files to a folder and does other commands

3. It does it silently, without any windows or terminals or user intervention

I stress on the silent part, so I cant choose some easy installers. Can you reccomend something that generates this executable?

For the curious: its a stealth packet logger program for my college project. The "stealth" part will be tried out only on xp2 virtual machines with IE6 (yeah, old stuff).

EDIT: answering the commenters: it is of a malware character. So I am running it in virtualbox, never on the loose. And I can compromise only an unpatched xp systems with IE6, without antivirus, that is from an OLD install disk. Thats the scope of the IE css use after free vulnerability, AFAIK never seen in the wild. So there is no unethical behavior involved.

Answer 1

You can easily embed resources either by linking them in, with the compiler, or by using a special program and instrumenting the windows API.

Something along the lines of :

char file_to_be_altered[] = "MyInstaller.exe"

HANDLE hUpdate = BeginUpdateResource( file_to_be_altered, FALSE );
UpdateResource( hUpdate, "MyResType", "MyResName1", 0, pData, data_len );
EndUpdateResource( hUpdate, FALSE );

Then when your executable runs, you enumerate your resources and select those that have the type "MyResType".

struct res_entry { BYTE* pData; unsigned int len; }

BOOL CALLBACK EnumNamesCB(
    HMODULE hModule,  // module handle
    LPCTSTR lpType,   // address of resource type
    LPTSTR lpName,    // address of resource name
    LONG_PTR lParam)      // 
{
    std::vector<res_entry>& lst = *(reinterpret_cast< std::vector<res_entry>* >( lParam ));
    HRSRC hRes = FindResource( hModule, lpName, lpType );
    if( hRes == 0 )     return TRUE;
    unsigned int len = SizeofResource( hModule, hRes );

    HGLOBAL hGlob = LoadResource( hModule, hRes );
    if( hGlob == 0 )    return TRUE;

    res_entry t;
    t.pData = LockResource( hGlob );
    t.len = len;


    lst.push_back( t );     // this is safe, because the resources are never deallocated
    return TRUE;
}

....

void enum_entries()
{
    std::vector<res_entry> lst;
    ::EnumResourceNames( hFileToQuery, "MyResType", &EnumNamesCB, reinterpret_cast<LONG_PTR>(&lst) );
}

You can do whatever you want with this data, e.g. CreateFile ... and the write the data out to disc.

NB: This is how installers may do it on windows, and this was developed to extract files to the temp dir and install from there.

Answer 2

The trivial way to do it is to create a very large array inside your program, and store the data to be extracted inside that array. When executed the program takes the array and writes it out to a file or files as needed, then executes the file you want to run once the files are extracted. See, for example, C Question: How to store data inside the executable file.

Once the program is compiled you can replace the data in the EXE using a binary editor to copy your files in place without having to convert your files to a C array or some other data structure every time you change your payload.

In order to keep the size down the primary program typically decompresses the array and expects a compressed array. A lot of installers simply use zip as the decompressor takes care of multiple files in one array, and you don't have to fiddle with adding a directory array and reference array - it's all built in, and command line zip compressors are common and easy to use.

Whether the primary program opens a terminal depends on how you program it. I expect you'll need it to be a win32 program so windows doesn't open a DOS terminal, and you simply don't open any windows inside your program. That's a separate question, though, so consider asking it as a new question.

As David points out, this process is typically automated in the linker stage. Each linker is slightly different, but you can check out Embedding resources in .exe using GCC for an example using one of the more common compilers.

I assume you know what you are doing, but keep in mind that there are a lot of unpatched stock winxp sp2 systems out there - assuming that you won't hurt anyone because you don't believe such systems are online is a poor choice. Make certain that your program doesn't have the ability to leave the virtual machines. There are ways, for instance to connect their networks without allowing the machines access to the internet, or your computer's network. Keep in mind that the Morris worm was a pet project that wasn't intended or expected to go wild either.