How to add a section In an EXE

Thanks Michel that would be my answer too.
Only a note :
if you add a new section, to obtain a valid pe (which olly can see)
you have to adjust the size of the previous section.
In the image you have posted you should also set the vsize of the .rsrc section to
10000 - a000

cheers
z.

[Michel]

you should also set the vsize of the .rsrc section to 10000 - a000

Do you think it's really necessary ?
Look that 65CA != 8000 - 1000 (sec .text)

Thank you Michel and zaratustra.I know the theory more than before.

But I was puzzled about what size and where I should fill in.

See the attached file.

I change the value twice for each place. But the Notepad.exe both could not run.


Maybe I'm thickheaded So could you please use Interkodex Screen Recorder to make avi for a simple sample if convenience ? Not necessary if inconvenience.

Originally Posted by Michel

Do you think it's really necessary ?
Look that 65CA != 8000 - 1000 (sec .text)

Notepad has an 'irregular' PE Header format. I will explain it later.
Please have a look at another exe, you should note that my assertion
about the virtual size is correct. ( You can obtain the same result
with the option rebuild pe in lordpe applied to notepad).
YOU WILL OBTAIN AN ERROR IF THE VSIZE OF YOUR ADDED SECTION IS 0.
Also when you add a new section you should specify the Raw offset in the file
where your data reside. In your case, you should also add some datas at the end of file. You can do it with winhex or some other program. Or with lordpe
for example loading the section directly from disk. It is the way I prefer.
Save your datas to disk and load a new section from disk with lordpe.
Fix the vsize of the previous last section to fit the new allotted section and try...
Please try also with a program different from notepad, or post the
data of your new section I can try it on my own.
Cheers.
Z.

Thanks all.

Someone told me a simple way to do that.

Just change the Vsize Rsize and Image size with the same size.

The exe ran normally. But I am not very satisfy with this way because I learnt little from it.Maybe I'm insatiable..Oh..~~~