Yet Another PE Backdoor Tool is a script to make backdoored PE executables. It uses the pefile
Python library for the necessary header modifications. No effort has been made to bypass AV
detection.
This has been done to death but most of the resources I found on this uses Olly and/or manual patching. I prefer fully automated solutions.
Modify decoder.template and shellcode.template to do what you want and then run:
./yapbt.py original.exe backdoored.exe
This script can backdoor a PE file in two ways:
- Create a new malicious section and change the program's entrypoint to the new section.
- Find a code cave, patch it and change the program's entrypoint to point to the code cave.
- Implement support for
x86_64. - Clean up.
- Better log messages.