Jump to content
Tuts 4 You

AddSection function no section header space


mateusReversing

Recommended Posts

mateusReversing

I have been trying to code my own pe explorer tool as a learning exercise but have been stuck on how to add a new section to the pe header when there is no space for another section header. I have looked at the functions source code given below and it doesn't seem to deal with this. Why is this?


https://bitbucket.org/mrexodia/titanengine-update/src/50379e53e9f3a1d9cf835e37e2fd7cbade61dc6a/TitanEngine/TitanEngine.PE.Section.cpp?at=master#cl-512


Link to post
mateusReversing

Thanks for responding, I have been struggling with this for weeks.


Below is the source code to add a new section, I have tried to implement it though the I am still getting section header overflow so .text is still being overwritten, I am not sure where in the code below such a problem is dealt with. I'm now going to try to change the FileAlignment and then move up all sections though this will have a ripple effect on other aspects of the code that are affected by FileAlignment.



PIMAGE_SECTION_HEADER CPELibrary::AddNewSection(char* szName,DWORD dwSize)
{
DWORD roffset,rsize,voffset,vsize;
int i=image_nt_headers->FileHeader.NumberOfSections;
rsize=PEAlign(dwSize, image_nt_headers->OptionalHeader.FileAlignment);
vsize=PEAlign(rsize, image_nt_headers->OptionalHeader.SectionAlignment);
roffset=PEAlign(image_section_header[i-1]->PointerToRawData+image_section_header[i-1]->SizeOfRawData,
image_nt_headers->OptionalHeader.FileAlignment);
voffset=PEAlign(image_section_header[i-1]->VirtualAddress+image_section_header[i-1]->Misc.VirtualSize,
image_nt_headers->OptionalHeader.SectionAlignment);
memset(image_section_header[i],0,(size_t)sizeof(IMAGE_SECTION_HEADER));
image_section_header[i]->PointerToRawData=roffset;
image_section_header[i]->VirtualAddress=voffset;
image_section_header[i]->SizeOfRawData=rsize;
image_section_header[i]->Misc.VirtualSize=vsize;
image_section_header[i]->Characteristics=0xC0000040;
memcpy(image_section_header[i]->Name,szName,(size_t)strlen(szName));
image_section[i]=(char*)GlobalAlloc(GMEM_FIXED | GMEM_ZEROINIT,rsize);
image_nt_headers->FileHeader.NumberOfSections++;
return (PIMAGE_SECTION_HEADER)image_section_header[i];
}
Link to post
  • 2 weeks later...
mateusReversing

Thank you, the second link you provided helped me greatly though it took me some to get it to work, I can now add sections.


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...