PE Portable Exe­cu­tung or DLL Dynam­ic Link­ing Libraries can be edit­ed to remove or add capa­bil­i­ties or own code.

Read and modify a PE file

The fol­low­ing Python3 script reads a file, prints out a head­er, mod­i­fied it to remove ASLR and write a new file with­out this flag.

f = pefile.PE('filename.exe')
print(hex(f.OPTIONAL_HEADER.DllCharacteristics)) // print as hex to work with masks
f.OPTIONAL_HEADER.DllCharacteristics = f.OPTIONAL_HEADER.DllCharacteristics ^ 0x0040 // xor with 0x0040 which is the value for DYNAMIC_BASE (=> ASLR) to enable or disable it.
f.write('filename.exe.new') // write the modified file.

Ressources

• Doc­u­men­ta­tion of the PE format.