Question

Lets say a have program.exe , i will create a python script that will

• read program.exe in binary mode and save it in variable data
• open mypytonprog.py in binary append mode
• append data to mypythonprog.py (?)

before this, mypythonprog.py would be prepared as:

program_data='''

after it, mypythonprog.py would continue as:

'''
programs continues....

(i want somehow to put that program code into a program_data variable)

This, does not work,of course, but can it be done in some way ?
What i want basicly is: mypythonfile.py to be able to create an exe file with binary data stored inside it.

I suppouse i have to encode that data to a shellcode to by able to put it inside mypythonfile.py,
right ?

Answer 1

import base64

exe = 'c:/users/me/program.exe'
script = 'c:/users/me/newpython.py'
chunksize = 6144
linelength = 80

with open(exe,'rb') as inf, open(script,'w') as outf:
    outf.write('program_data = """')

    while True:
        progdata = inf.read(chunksize)
        if len(progdata):
            progdata = progdata.encode("base64")
            outf.writelines(progdata[i:i+linelength] for i in range(0, len(progdata), linelength))
        else:
            break

    outf.write('""".decode("base64")')

Edit:

The idea is to process the input file in convenient chunks rather than reading a potentially-huge file into memory.

After base64-encoding the chunk, I then split it into 80-char lines (this is basically just to keep it manageable in the text editor) and write it to output.

I wrap the data in program_data = “”” .. “””.decode(“base64”) such that when Python loads the file, the data will be automatically decrypted – program_data will contain the binary data you desire.

8096 was a brain fart – I meant to use 8192 bytes (8KB). Then I realized there was a second problem; encoding a chunk other than a multiple of 3 chars long results in ‘=’-padded output, which prematurely truncates decoding. I have changed the chunk size to 6KB = 512 bytes (default NTFS block size) * 3 chars * 4 (arbitrary multiple); this seems to work as expected.

Hope that helps!