![]() |
|
|
|
#1
|
|||
|
|||
|
I don't know how to explain it detailedly ,just like this:
0001: PUSH EAX 0002: DEC EDI 0003: INC EBP . . I want this: 0001: PUSH EAX 0002: JMP 0008 0003: INC EBP . . . 0008: NOP 0009: DEC EDI 0010: JMP 0003 ============================ Begin 0008 is the added section, use PEeditor can add a section, someone told me it needs change the ImageSize at the same time,PEeditor also can do this. But I failed.When I use OllyDbg open it , I was told it's not a valid EXE file. Thank you very much for guidance. Last edited by netxman; 12-13-2004 at 00:11. |
|
#2
|
||||
|
||||
|
Adding Section
You can use Code Snippet Creator for that (you can find it on programmer's tools site)
|
|
#3
|
|||
|
|||
|
adding a section is a very simple task with lordpe.
when you add a new section in a exe you should control the following things: 1) section do not overlap 2) the virtual size of each section must fill entirely the range between one section and the other. Lordpe is a very useful tool as it can do it automatically. In particular it can be forced to do the step 2) with the option recontruct pe. you can post the new section header table so i can show you where the problem is (grab the section header with lordpe or some other tool). |
|
#4
|
|||
|
|||
|
Thanks LOUZEW , Code Snippet Creator is a good tool but it's a little difficulty for me, it needs MASM environment first.
Thanks zaratustra , I may need your further help. What I want in my attached file , this is the first step. Maybe I understand how to do this then I can go to next step... Big thanks.
|
|
#5
|
|||
|
|||
|
Q1 : VirtualSize is the size which is occupied by the section when this is loaded in RAM.
Q2 : RawSize is the size which is occupied by the section on the HD. Q3 : When you attribue some value at the VirtualSize of a section, SizeOfImage, which is the VirtualSize of the whole exe when loaded in RAM, will be automatically update. I hope this can help you... Last edited by Michel; 12-14-2004 at 00:39. |
|
#6
|
|||
|
|||
|
Thanks Michel that would be my answer too.
Only a note : if you add a new section, to obtain a valid pe (which olly can see) you have to adjust the size of the previous section. In the image you have posted you should also set the vsize of the .rsrc section to 10000 - a000 cheers z. |
![]() |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| chinese Section | Utshiha | General Discussion | 6 | 02-02-2015 21:32 |