How does msfvenom use an existing .exe file as a template?

[Morsmalleo]

Another quick question here guys, similar to my one about APK's but this one is for EXE's as both standalone Payloads and as templates.

Does anyone happen to know how msfvenom generates Windows .exe payloads? I'd also like to know how msfvenom is able to Bind an existing Windows executable (.exe) payload to an original Windows Executable (.exe) File, if anyone happens to know.

Any answers on this would be greatly appreciated!

[Morsmalleo]

Another quick question here guys, similar to my one about APK's but this one is for EXE's as both standalone Payloads and as templates.

Does anyone happen to know how msfvenom generates Windows .exe payloads? I'd also like to know how msfvenom is able to Bind an existing Windows executable (.exe) payload to an original Windows Executable (.exe) File, if anyone happens to know.

Any answers on this would be greatly appreciated!

Still hoping for an answer on this one.

[timwr]

I think it depends on the arguments you give to msfvenom, but it looks like it tries to add a new section to the exe:
https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/util/exe.rb#L246

[PYfffE]

2011 year post, may be useful 🤔
https://www.scriptjunkie.us/2011/04/why-encoding-does-not-matter-and-how-metasploit-generates-exes/