5 replies to this topic

[TheKingUnderTheHill]

Right,

I used to be able to do this years ago, but it's slipped my memory and i cant seem to find a straight
answer online at all, so brace for ultra-super-mega-noob question:

How do i merge a .exe file into an .mp3 or .jpeg file and have it execute when the file is opened?

Seriously, i did this in like, Year 8 at school and it was fantastic fun, just cant seem to remember HOW exactly i did it!

[digip]

ADS or alternate data streams, can be used to hide files (visually, but not from the system or antivirus). If someone deletes the main file, the hidden file disappears too. You can merge, and uncomepress them from that state as well to extract the hidden file. Requirements, filesystem must be NTFS, does not work on fat systems.

C:\> type C:\windows\system32\notepad.exe > c:\windows\system32\calc.exe:notepad.exe
C:\> start c:\windows\system32\calc.exe:notepad.exe

See here for more help: https://www.owasp.or...ate_data_stream

Not sure if it still works on windows 7 machines though.Just tested it, it does work. In windows 7 they added a feature to see alternate data streams, do a dir /r, shows if any are attached to a file.

Edited by digip, 21 October 2011 - 10:39 PM.

[TheKingUnderTheHill]

Awesome, thanks for the reply man.

Just wondering, would this run both files when run, or just the 'visible' file?

[digip]

Awesome, thanks for the reply man.

Just wondering, would this run both files when run, or just the 'visible' file?

Only runs the first file and if needed, the program first started could call the ADS file if instructed to. To access the hidden file directly, you need to call it from a command prompt like "notepad file1.exe:hiddenfile.txt"

[Iain]

I seem to recall that iexpress.exe can merge files and have them both run, though I can't be 100% sure about that because I've never played with it. It's built into Windows XP.

[digip]

I seem to recall that iexpress.exe can merge files and have them both run, though I can't be 100% sure about that because I've never played with it. It's built into Windows XP.

iexpress is a packager though(from what I recall, used for sending multiple files to other systems), and not exactly the same thing. What ADS files are, is the same file, but more or less hidden and attached to another file. Windows ADS files only works on NTFS systems. Drag them to a fat32 drive, like a thumb drive, and the hidden files are deleted. The only way to run the hidden file, is to call it from its hidden path, like I showed in the previous post.