3

I am trying to add a 1000 byte code cave using LordPE to a standalone exe. From what I understand I have to edit the PE header with a new section of 1000 bytes then open the exe in a hex editor and add 1000 bytes to the end of the file.

When I add the new section the offset is not at the end of the file and It actually points to existing code. If I change the RawOffset to match the actual end of file 0xAE370 it gets corrupted.

Why won't the new section get added at the real end of file? Also, how can I add a new 1000 byte section without corrupting the file?

Update: The debugger still wasn't perfect on the location of the new section in the memory map but I can see my new bytes ~200h down from where they are listed. To get it to work I had to:

  • Add the new section using CFF
  • Save it and open the file in a hex editor to find the true RawOffset
  • Then manually change the RawOffset in CFF to where my new bytes were actually placed by CFF 0xAE378
  • Back in CFF right click and rebuild PE header and rebuild image size (not sure if rebuilding the size part was necessary)
  • Now in the debugger navigate to where it says .NewSec is and scroll down a few hundred bytes and the new inserted bytes are there

Still not sure why the memory map is slightly off but it's not too bad. I suppose once you find them you could edit the virtual address of the section to reflect where it actually is once loaded into memory.

enter image description here

Improve this question
6
  • Please note that there is hardly any point in creating a cave like this. It would be much easier to inject code the 'traditional way' (allocate memory in a running process). In the context of process injection, code caving is a sophisticated technique searching for usable gargabe / alignment / zero bytes. Often, you need to support using to smaller caves instead of a larger one. Or do you want to infect an executable to run your code on startup?
    – Nordwald
    Mar 29, 2017 at 4:58
  • As for the 'add section at pe end' issue: Did you actually add bytes? There is good material on how to do this. For example, this one: resources.infosecinstitute.com/adding-a-section-to-pe-binary
    – Nordwald
    Mar 29, 2017 at 5:00
  • Thanks for the resource I'll look into it. And yes I am infecting an exe with a reverse shell and trying to preserve the original exe.
    – Nitro
    Mar 29, 2017 at 5:05
  • Hmm yeah I am actually adding the bytes. The issue is when I add a new section the raw offset is pointing at a place that is still part of the previous sections data. I tried fiddling with the raw offset and even adding a couple large sections to ensure that I am getting past the previous section but no luck the file gets corrupted or I end up outside of RWE areas somehow. If it helps I am using the 32 bit portable Putty.exe for this example.
    – Nitro
    Mar 29, 2017 at 5:29
  • You can edit the new section from within CFF
    – NirIzr
    Mar 31, 2017 at 23:53

1 Answer 1

Reset to default
7

Adding sections to PE files is not always as simple as editing the sections table. Sometimes you'll have to handle several edge cases such as menifest, signatures and other potential end-of-file optional "extensions".

Although LordPE is a great tool, it isn't the best tool for this task. It is too low-level, and doesn't let you create a complete new section transparently. It will let you edit the different fields as required for adding the new section, but you'll have to handle everything yourself.

There are more advanced PE editors, such as CFF Explorer, that provide the functionality to create sections from scratch. It will increase the file size of you and create a section you can directly edit from within CFF Explorer.

To add a new section, open a file with CFF Explorer, select the Section Headers option from the lefthand tree view, right click on the sections table, select the "Add Section (Empty Space)" option like in the following picture:

enter image description here

Then, specify the size of the new section.

To edit the new section select it, and use the bottom panel to modify, paste, copy or fill the hex view of the section. You can right click on it to open a menu with additional editing options.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.