{"id":21611589,"url":"https://github.com/oagoulart/wrappem","last_synced_at":"2026-03-04T00:33:00.243Z","repository":{"id":46279384,"uuid":"283084773","full_name":"oAGoulart/wrappem","owner":"oAGoulart","description":"A small tool to inject PE files import address table with an external payload DLL.","archived":false,"fork":false,"pushed_at":"2021-11-23T23:56:56.000Z","size":471,"stargazers_count":13,"open_issues_count":0,"forks_count":4,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-25T03:34:44.985Z","etag":null,"topics":["hooks","reverse-engineering","shared-library","tool","x86"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/oAGoulart.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null},"funding":{"patreon":"AGoulart","ko_fi":"agoulart"}},"created_at":"2020-07-28T03:14:11.000Z","updated_at":"2024-11-15T07:38:56.000Z","dependencies_parsed_at":"2022-09-03T03:03:36.435Z","dependency_job_id":null,"html_url":"https://github.com/oAGoulart/wrappem","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oAGoulart%2Fwrappem","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oAGoulart%2Fwrappem/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oAGoulart%2Fwrappem/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/oAGoulart%2Fwrappem/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/oAGoulart","download_url":"https://codeload.github.com/oAGoulart/wrappem/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248348149,"owners_count":21088819,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hooks","reverse-engineering","shared-library","tool","x86"],"created_at":"2024-11-24T21:13:10.912Z","updated_at":"2026-03-04T00:33:00.231Z","avatar_url":"https://github.com/oAGoulart.png","language":"C++","funding_links":["https://patreon.com/AGoulart","https://ko-fi.com/agoulart"],"categories":[],"sub_categories":[],"readme":"[![WrappEm](https://live.staticflickr.com/65535/50212827266_ecedc91f80_h.jpg)]()\n\n![Platform](https://img.shields.io/badge/platform-win--32%20%7C%20win--64-blue)\n![GitHub release (latest by date)](https://img.shields.io/github/v/release/oAGoulart/wrappem?color=green)\n[![License](https://img.shields.io/badge/License-MS--RL-blue)](./LICENSE)\n\n**WARNING:** This version can only work if there's enough empty space on `idata` section. Two more methods are being worked on to allow for cases where not enough space is available.\n\nFrom old version:\n\u003e This is a small tool that can generate a hooked PE file which will import your custom DLL into its process.\n\u003e With this you can inject a payload into a process using a DLL.\n\u003e I took inspiration to make this tool from Michael Chourdakis' [article], but his implementation was not suited for my needs, so after some research and testing I created this tool.\n\u003e The first implementation I made used the same method described in the article to create a proxy DLL, this version however modifies a DLL/Exe imports table to force Windows to import your payload DLL into the process.\n\u003e If you're interested in this method you can learn more about [PE Format](https://docs.microsoft.com/en-us/windows/win32/debug/pe-format) and the [Import Table](http://sandsprite.com/CodeStuff/Understanding_imports.html) (it's a lot of stuff tho, so get some coffee first). Also, consider checking my brief explanation on how this tool works here: [Injecting payloads in DLLs](https://oagoulart.github.io/rambles/injecting-payloads-in-dlls).\n\n## Method I: import table relocation\n\n**Requirements:**\n1. Enough padding space for import table size plus one entry;\n1. Import table size bigger or equal to payload data size.\n\n```text\n standard idata section structure               after relocation\n────────┬──────────────────┬──────    ────────┬──────────────────┬──────\n .idata │                  │ start     .idata │                  │ start\nsection │  address tables  │          section │  address tables  │\n        │     (thunk)      │                  │     (thunk)      │\n     ┌──┼                  ◄─┐           ┌────►                  ┼─┐\n     │  ├──────────────────┤ │           │    ├──────────────────┤ │\n     │  │                  ┼─┘           │    +                  + │\n     │  │   import table   ┼──┐          │    +   payload data   + │\n     │  │                  ┼─┐│          │┌───►                  + │\n     │  ├──────────────────┤ ││          ││   ├──────────────────┤ │\n     │  │                  ◄─┘│          ││   │                  │ │\n     │  │   lookup tables  │  │          ││   │   lookup tables  │ │\n     │  │      (32/64)     │  │          ││┌──►      (32/64)     │ │\n     │┌─┼                  │  │          │││┌─┼                  │ │\n     ││ ├──────────────────┤  │          ││││ ├──────────────────┤ │\n     │└─►                  ◄──┘          │││└─►                  ◄─┘\n     │  │names and ordinals│             │││  │names and ordinals│\n     └──►                  │             │││  │                  ◄─┐\n        └──────────────────┘             │││  ├──────────────────┤ │\n        :                  :             ││└──┼                  ┼─┘\n        :     padding      :             │└───┼   import table   │\n        :                  : end         └────┼                  │ end \n──────────────────────────────────    ────────┴──────────────────┴──────\n```\n\n## Method II: import table expansion\n\n**NOT IMPLEMENTED YET**\n\n**Requirements:**\n1. Enough padding space for one table entry plus data;\n1. All relative virtual addresses (RVAs) in `idata` must be re-calculated.\n\nAfter import table expansion and re-building:\n```text\n────────┬──────────────────┬──────\n .idata │  address tables  │ start\nsection │     (thunk)      │\n        │- - - - - - - - - │\n     ┌──┼     payload      ◄─┐\n     │  ├──────────────────┤ │\n     │  │   import table   ┼─┘\n     │  │- - - - - - - - - ┼──┐\n     │  │     payload      ┼─┐│\n     │  ├──────────────────┤ ││\n     │  │   lookup tables  ◄─┘│\n     │┌─┼      (32/64)     │  │\n     ││ │- - - - - - - - - │  │\n     ││ │     payload      │  │\n     ││ ├──────────────────┤  │\n     │└─►                  ◄──┘\n     │  │names and ordinals│\n     │  │- - - - - - - - - │\n     │  │     payload      │\n     └──►                  │\n        └──────────────────┘\n        :     padding      : end\n──────────────────────────────────\n```\n\n## Method III: import data section relocation\n\n**NOT IMPLEMENTED YET**\n\n**Requirements:**\n1. Offset of new section entry must be less than section alignment;\n1. All RVAs must be incremented by virtual offset.\n\n```text\n            before append                           after append\n         ┌──────────────────┐                   ┌──────────────────┐\n PE file │      headers     │           PE file │      headers     │\n         │                  │                   │                  │\n─────────┼──────────────────┼──────    ─────────┼──────────────────┼──────\nsections │                  │ start    sections │                  │ start\n         │      .rsrc       │                   │      .rsrc       │\n         ├──────────────────┤                   ├──────────────────┤\n         │                  │                   │                  │\n         │      .data       │                   │      .data       │\n         ├──────────────────┤                   ├──────────────────┤\n         │                  │                   │                  │\n         │      .idata      │                   │     (empty)      │\n         ├──────────────────┤                   ├──────────────────┤\n         :                  :                   :                  :\n         :       ...        :                   :       ...        :\n         :                  :                   :                  :\n         ├──────────────────┤                   ├──────────────────┤\n         │                  │                   │                  │\n         │                  │                   │                  │\n         │      .text       │                   │      .text       │\n         │                  │                   │                  │\n         │                  │ end               │                  │\n ────────┴──────────────────┴──────     - - - - ┼──────────────────┼ - - -\n                                                │                  │\n                                                │      .idata      │ end\n                                        ────────┴──────────────────┴──────\n```\n\n\n[article]: https://www.codeproject.com/articles/16541/create-your-proxy-dlls-automatically\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foagoulart%2Fwrappem","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Foagoulart%2Fwrappem","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foagoulart%2Fwrappem/lists"}