3

Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?

1
  • Did you ever figure out the solution to your problem by any chance? Dec 23, 2019 at 10:50

1 Answer 1

2

Creating section does work but saving them has a long outstanding bug report. I think, not sure, I saw now the bug report has been marked fixed and closed in some version.

But just tried out wci command and I didn't see the Newsection written out to file in disk so maybe you should pursue the issue in Radare's reports section.

:\>radare2 -w jmpesp.exe
 -- The door is everything ...

[0x00401000]> e io.cache = true
[0x00401000]> e io.cache.write =true
[0x00401000]> e io.cache.read  = true

[0x00401000]> S
[00:00] * pa=0x00000200 mr-x va=0x00401000 sz=0x0200 vsz=0x1000 .text
[00:01] . pa=0x00000400 mr-- va=0x00402000 sz=0x0200 vsz=0x1000 .rdata

[0x00401000]> S 0x600 0x403000 0x200 0x1000 .what rwx

[0x00401000]> S
[00:00] * pa=0x00000200 mr-x va=0x00401000 sz=0x0200 vsz=0x1000 .text
[00:01] . pa=0x00000400 mr-- va=0x00402000 sz=0x0200 vsz=0x1000 .rdata
[-1:02] . pa=0x00000600 -rwx va=0x00403000 sz=0x0200 vsz=0x1000 .what

[0x00401000]> om
 6 fd: 3 +0x00000600 0x00403000 - 0x004031ff -rwx fmap..what
 5 fd: 6 +0x00000000 0x00403200 - 0x00403fff -rwx mem..what
 4 fd: 3 +0x00000200 0x00401000 - 0x004011ff -rwx fmap..text
 3 fd: 5 +0x00000000 0x00401200 - 0x00401fff mrwx mmap..text
 2 fd: 3 +0x00000400 0x00402000 - 0x004021ff -rw- fmap..rdata
 1 fd: 4 +0x00000000 0x00402200 - 0x00402fff mrw- mmap..rdata

[0x00401000]> wci

[0x00401000]> S
[00:00] * pa=0x00000200 mr-x va=0x00401000 sz=0x0200 vsz=0x1000 .text
[00:01] . pa=0x00000400 mr-- va=0x00402000 sz=0x0200 vsz=0x1000 .rdata
[-1:02] . pa=0x00000600 -rwx va=0x00403000 sz=0x0200 vsz=0x1000 .what
[0x00401000]> 

and quitting and reopening doesn't show the new Section

[0x00401000]> q

:\>radare2 -w jmpesp.exe
 -- *(ut64*)buffer ought to be illegal
[0x00401000]> S
[00:00] * pa=0x00000200 mr-x va=0x00401000 sz=0x0200 vsz=0x1000 .text
[00:01] . pa=0x00000400 mr-- va=0x00402000 sz=0x0200 vsz=0x1000 .rdata
[0x00401000]>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.