bronson wrote:
I have written a little tool in MASM which will add a new section to an executable.
It adds an empty 110h bytes onto the end of the exe then updates the section table. Opening the exe in LordPE looks like this:
Name VOffset VSize ROffset RSize Flags
.text 00001000 00001244 00000400 00001400 60500060
.data 00003000 00000018 00001800 00000200 C0300040
etc..
.rsrc 00007000 000002D4 00002400 00000400 C0300040
.new 00008000 00000110 00002800 00000110 E0000060
.new being the section I have added. I have tried to make use of this section in OllyDbg but it just seems to cause crashes, is there anything else I need to do before it is usable?
Also, code tags on the forum seem to use the same font, rather than a fixed width font.
Seems easy, all you have to do is:
1) Make sure that the place for the new IMAGE_SECTION_HEADER structure is not used. For example, if the PE you are updating already has a bound imports structure, you are very likely to be overwriting the bound imports info (that may cause an access violation in the new PE).
2) Increment the "NumberOfSections" field.
3) The VirtualAddress of the new section should be equal to (The VirtualAddress of its preceding section + the section-aligned VirtualSize of its preceding section).
3) New SizeOfImage = Old SizeOfImage + section-aligned VirtualSize of new section.Statistics: Posted by waliedassar — Mon Sep 24, 2012 10:55 am
]]>
