solved

Edited July 15, 201312 yr by SkyHigh

that should be ok, if you are planning to inject the sectoin after the section table and before the first section.

 

However, you might want to grab the start of the first section from the actual section table (if possible, keep in mind that section tables arent necessarely in order...).

That way, you can work around faulty values for sizeofheaders, although the windows loader ensures that the value is roughly in the right range.

 

you will want to check fora minimal size, thouhg:

(...) >= hsize - sizeof(image_section_header) 

in order to have enough space for a section header and purely virtual section.

solved

Edited July 15, 201312 yr by SkyHigh

deleted. Sorry for any confusion. I misread your post.

 

 

Edited July 14, 201312 yr by CondZero

quetion solved thanks deepzero

Edited July 15, 201312 yr by SkyHigh