How do I poke the flag in a win32 PE that controls console window display

Question

I have an executable which is part of a batch process. This one executable opens a console window, which is annoying since it's useless to the end user and steals focus away from their active task.

We can't compile a new version from of this EXE from source (easily). Is there an easy way to twiddle this setting in the PE?

Answer 1

Found it.

editbin.exe /subsystem:windows foo.exe

editbin.exe is part of MSVC

Answer 2

I have wrote it with python based on the PE specification http://msdn.microsoft.com/en-us/library/windows/hardware/gg463119.aspx

I'm not sure that Windows EXE binaries with console|windows subsystem have same Entry Point Format (with same arguments), but it seem that it is so.

Python Code:

import sys
import struct

if len(sys.argv) < 4:
    print "Change Exe Run Mode Application by [email protected]\nNot sufficient parametrs. 'exe_src_name.exe' 'exe_dest_name.exe' 'to_console' or 'to_windows'"
    sys.exit(-1)

source = open(sys.argv[1], "rb")
dest   = open(sys.argv[2], "w+b")
dest.write(source.read())

dest.seek(0x3c)
(PeHeaderOffset,)=struct.unpack("H", dest.read(2))

dest.seek(PeHeaderOffset)
(PeSignature,)=struct.unpack("I", dest.read(4))
if PeSignature != 0x4550:
    print "Error in Find PE header"

dest.seek(PeHeaderOffset + 0x5C)

if sys.argv[3].strip() == "to_console":
    # console mode
    dest.write(struct.pack("H", 0x03))
elif sys.argv[3].strip() == "to_windows":
    # window mode
    dest.write(struct.pack("H", 0x02))
else:
    print "Wrong Format: '" + sys.argv[3] + "'"

source.close()
dest.close()

print "Completed succesfully.."