Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 12-13-2004, 00:08
netxman
 
Posts: n/a
Red face How to add a section In an EXE

I don't know how to explain it detailedly ,just like this:

0001: PUSH EAX
0002: DEC EDI
0003: INC EBP
.
.
I want this:

0001: PUSH EAX
0002: JMP 0008
0003: INC EBP
.
.
.
0008: NOP
0009: DEC EDI
0010: JMP 0003

============================

Begin 0008 is the added section, use PEeditor can add a section, someone told me it needs change the ImageSize at the same time,PEeditor also can do this. But I failed.When I use OllyDbg open it , I was told it's not a valid EXE file.

Thank you very much for guidance.

Last edited by netxman; 12-13-2004 at 00:11.
Reply With Quote
  #2  
Old 12-13-2004, 05:12
LOUZEW's Avatar
LOUZEW LOUZEW is offline
Friend
 
Join Date: Feb 2002
Location: Britanny
Posts: 101
Rept. Given: 1
Rept. Rcvd 2 Times in 1 Post
Thanks Given: 6
Thanks Rcvd at 7 Times in 7 Posts
LOUZEW Reputation: 2
Adding Section

You can use Code Snippet Creator for that (you can find it on programmer's tools site)
Reply With Quote
  #3  
Old 12-13-2004, 15:37
zaratustra
 
Posts: n/a
adding a section is a very simple task with lordpe.
when you add a new section in a exe you should control the following things:
1) section do not overlap
2) the virtual size of each section must fill entirely the range between one
section and the other.
Lordpe is a very useful tool as it can do it automatically.
In particular it can be forced to do the step 2) with the option recontruct pe.
you can post the new section header table so i can show you where the problem is (grab the section header with lordpe or some other tool).
Reply With Quote
  #4  
Old 12-13-2004, 22:41
netxman
 
Posts: n/a
Thanks LOUZEW , Code Snippet Creator is a good tool but it's a little difficulty for me, it needs MASM environment first.

Thanks zaratustra , I may need your further help.

What I want in my attached file , this is the first step. Maybe I understand how to do this then I can go to next step...

Big thanks.
Attached Images
File Type: jpg exe.jpg (87.7 KB, 26 views)
Reply With Quote
  #5  
Old 12-14-2004, 00:36
Michel Michel is offline
Friend
 
Join Date: Sep 2004
Location: France
Posts: 66
Rept. Given: 2
Rept. Rcvd 6 Times in 1 Post
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Michel Reputation: 6
Q1 : VirtualSize is the size which is occupied by the section when this is loaded in RAM.

Q2 : RawSize is the size which is occupied by the section on the HD.

Q3 : When you attribue some value at the VirtualSize of a section, SizeOfImage, which is the VirtualSize of the whole exe when loaded in RAM, will be automatically update.

I hope this can help you...

Last edited by Michel; 12-14-2004 at 00:39.
Reply With Quote
  #6  
Old 12-14-2004, 01:08
zaratustra
 
Posts: n/a
Thanks Michel that would be my answer too.
Only a note :
if you add a new section, to obtain a valid pe (which olly can see)
you have to adjust the size of the previous section.
In the image you have posted you should also set the vsize of the .rsrc section to
10000 - a000

cheers
z.
Reply With Quote
Reply


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
chinese Section Utshiha General Discussion 6 02-02-2015 21:32


All times are GMT +8. The time now is 23:30.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )