ridter/binhol

BinHol is a security research tool that lets you insert custom code into existing Windows executable files. Think of it as a way to modify a program's behavior after it has been compiled, without needing access to the original source code. It is designed for people working in cybersecurity, malware analysis, or software testing who need to study how programs behave when their code is altered. The tool offers three different methods for injecting code into a Windows executable. The first method, "Function Patch," replaces or modifies a specific function within the target program. The second, "Entrypoint Hijack," changes the starting point of the executable so that your custom code runs first when the program launches. The third, "TLS Injection," uses a built-in Windows mechanism called Thread Local Storage to run your code at a very early stage of the program's startup. You choose the method that best fits your research scenario, run the tool from the command line, and it produces a modified version of the executable. Security researchers and penetration testers are the primary audience. For example, a researcher studying how antivirus software detects threats might use this tool to embed test code into a harmless utility program, then observe whether security systems catch the modification. It is also useful for testing how applications respond to unexpected changes in their internal logic. The tool handles Windows digital signatures, meaning it can even modify programs that carry a publisher's signature, which is valuable for testing endpoint security tools. It is worth noting that the project is built using the Go programming language and does not rely on heavy external code libraries for dissecting binary files. The README is clear that this is strictly an educational and research tool. Modifying executables can break them, and antivirus software will likely flag the results as suspicious. You should back up any files before modifying them.