I am trying to add a 1000 byte code cave using LordPE to a standalone exe. From what I understand I have to edit the PE header with a new section of 1000 bytes then open the exe in a hex editor and add 1000 bytes to the end of the file.
When I add the new section the offset is not at the end of the file and It actually points to existing code. If I change the
RawOffset to match the actual end of file
0xAE370 it gets corrupted.
Why won't the new section get added at the real end of file? Also, how can I add a new 1000 byte section without corrupting the file?
Update: The debugger still wasn't perfect on the location of the new section in the memory map but I can see my new bytes ~200h down from where they are listed. To get it to work I had to:
- Add the new section using CFF
- Save it and open the file in a hex editor to find the true RawOffset
- Then manually change the RawOffset in CFF to where my new bytes were actually placed by CFF
- Back in CFF right click and rebuild PE header and rebuild image size (not sure if rebuilding the size part was necessary)
- Now in the debugger navigate to where it says .NewSec is and scroll down a few hundred bytes and the new inserted bytes are there
Still not sure why the memory map is slightly off but it's not too bad. I suppose once you find them you could edit the virtual address of the section to reflect where it actually is once loaded into memory.