What is the Backdoor Factory and how does it implant backdoors into EXE files?
The Backdoor Factory (BDF) is a tool that modifies PE executable files to inject a payload and alter program execution flow. It works by either adding a new section with RWE permissions or using existing code caves within the file's sections, then patching the entry point to jump to the payload and return to normal execution. This technique allows an attacker to maintain functionality while executing a backdoor, such as a reverse shell.
Backdoor FactoryEXEbackdoorPE filecode cavespayloadRWE permissions