PE section question

[Guest SkyHigh]

solved

Edited July 15, 2013 by SkyHigh

[deepzero]

that should be ok, if you are planning to inject the sectoin after the section table and before the first section.

 

However, you might want to grab the start of the first section from the actual section table (if possible, keep in mind that section tables arent necessarely in order...).

That way, you can work around faulty values for sizeofheaders, although the windows loader ensures that the value is roughly in the right range.

 

you will want to check fora minimal size, thouhg:

(...) >= hsize - sizeof(image_section_header) 

in order to have enough space for a section header and purely virtual section.

[Guest SkyHigh]

solved

Edited July 15, 2013 by SkyHigh

[CondZero]

deleted. Sorry for any confusion. I misread your post.

 

 

Edited July 14, 2013 by CondZero

[Guest SkyHigh]

quetion solved thanks deepzero

Edited July 15, 2013 by SkyHigh