Saving a modified PE File

[BigJk]

First of all, PeNet is awesome. I'm just missing the ability to write modified headers / file back to disk. Is this feature really not implemented or did I miss something? In case its really missing is there a chance to see it implemented in the future?

[secana]

Hi @BigJk,
you are right, the feature is missing. I've always wanted to add it but currently I do not have the time. You can try the following, maybe it's enough for you use case:

using System;

namespace PeSave
{
    class Program
    {
        static void Main(string[] args)
        {
            var peFile = new PeNet.PeFile(@"c:\windows\system32\kernel32.dll");

            // do your changes here on the peFile object
            peFile.ImageNtHeaders.FileHeader.Machine = 0x111;
            peFile.ImageNtHeaders.OptionalHeader.BaseOfCode = 0x2222;

            // save the changed PE file to disk
            System.IO.File.WriteAllBytes("myChangedPeFile", peFile.Buff);
        }
    }
}

PeNet works internally by loading the whole PE file into a buffer. All changes you make are done to this buffer in memory. If you want to save your changes, you just have to save the buffer.

I hope that helps.

Regards,
Secana

[BigJk]

@secana Thanks for the answer! I expected the Buff variable to just hold the original version so I didn't think about that. I will check if it works.

[secana]

Note to self: Add a "save" function in PeNet