mateusReversing Posted October 13, 2014 Posted October 13, 2014 I have been trying to code my own pe explorer tool as a learning exercise but have been stuck on how to add a new section to the pe header when there is no space for another section header. I have looked at the functions source code given below and it doesn't seem to deal with this. Why is this?https://bitbucket.org/mrexodia/titanengine-update/src/50379e53e9f3a1d9cf835e37e2fd7cbade61dc6a/TitanEngine/TitanEngine.PE.Section.cpp?at=master#cl-512
simple Posted October 13, 2014 Posted October 13, 2014 That code failed for me too. Try step 1 in this tut it works on every .exe I tried. http://www.codeproject.com/Articles/12532/Inject-your-code-to-a-Portable-Executable-file#PEMakerDownloadLink1 1
mateusReversing Posted October 15, 2014 Author Posted October 15, 2014 Thanks for responding, I have been struggling with this for weeks.Below is the source code to add a new section, I have tried to implement it though the I am still getting section header overflow so .text is still being overwritten, I am not sure where in the code below such a problem is dealt with. I'm now going to try to change the FileAlignment and then move up all sections though this will have a ripple effect on other aspects of the code that are affected by FileAlignment. PIMAGE_SECTION_HEADER CPELibrary::AddNewSection(char* szName,DWORD dwSize) { DWORD roffset,rsize,voffset,vsize; int i=image_nt_headers->FileHeader.NumberOfSections; rsize=PEAlign(dwSize, image_nt_headers->OptionalHeader.FileAlignment); vsize=PEAlign(rsize, image_nt_headers->OptionalHeader.SectionAlignment); roffset=PEAlign(image_section_header[i-1]->PointerToRawData+image_section_header[i-1]->SizeOfRawData, image_nt_headers->OptionalHeader.FileAlignment); voffset=PEAlign(image_section_header[i-1]->VirtualAddress+image_section_header[i-1]->Misc.VirtualSize, image_nt_headers->OptionalHeader.SectionAlignment); memset(image_section_header[i],0,(size_t)sizeof(IMAGE_SECTION_HEADER)); image_section_header[i]->PointerToRawData=roffset; image_section_header[i]->VirtualAddress=voffset; image_section_header[i]->SizeOfRawData=rsize; image_section_header[i]->Misc.VirtualSize=vsize; image_section_header[i]->Characteristics=0xC0000040; memcpy(image_section_header[i]->Name,szName,(size_t)strlen(szName)); image_section[i]=(char*)GlobalAlloc(GMEM_FIXED | GMEM_ZEROINIT,rsize); image_nt_headers->FileHeader.NumberOfSections++; return (PIMAGE_SECTION_HEADER)image_section_header[i]; }
simple Posted October 15, 2014 Posted October 15, 2014 The above code works for me so ur probably doing something wrong. Try this cli tool. https://github.com/Ge0/PeTools/tree/master/PeAddSection/x86
mateusReversing Posted October 27, 2014 Author Posted October 27, 2014 Thank you, the second link you provided helped me greatly though it took me some to get it to work, I can now add sections.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now