Jump to content

Patching PE exe's to run on XP


opm

Recommended Posts

I'm running 32-bit XP Pro SP3 within a Win 10 Pro Hyper-V VM, and I want to execute a Win32 binary in XP that was designed for a later version of Windows.  If the binary was a traditional exe, I would use dumpbin to validate the subsystem was later than 5.1, edit the header with editbin to set the subsystem to 5.1, confirm the change with dumpbin, and I'd be done.

However, the exe is a PE containing another exe binary, a DLL, and some resource files.  I could try using editbin on the internal exe and dll, but I wanted to check here first to see if there's a better way of doing this.  The PE is from MS, but I'm not aware of MS command-line tools that can unpack and repack a PE - I'd like to do that first and confirm the result as being identical to the original before I unpack, edit, and repack.

I'm interested in a general solution for this PE patching job, but (if anyone's interested) the PE I'm looking at first is the 32-bit virus definitions update file for MS Security Essentials, named mpam-fe.exe, and containing mpengine.dll, MpSigStub.exe, and the updated virus definitions.  The PE and both internal binaries specify a subsystem version of 6.0

Link to comment
Share on other sites


I found the epic 36-page MSFN topic "Microsoft security essentials and Windows XP" which brought me up to date with the state of play.  Genuine thanks to the main contributors there, some great stuff in terms of workarounds and knowledge sharing over three years of fighting the good fight.  That game ended 12 months ago, so for my immediate XP needs I've uninstalled MSE and installed Panda AV which is still based on .NET 4.0 and so (for now) remains XP-compatible.  For the more general task of PE unpacking/updating/repacking I'll continue looking at options and am interested in learning about preferred tools and techniques for that.

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...