Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
1 Answer
Creating section does work but saving them has a long outstanding bug report. I think, not sure, I saw now the bug report has been marked fixed and closed in some version.
But just tried out wci command and I didn't see the Newsection written out to file in disk so maybe you should pursue the issue in Radare's reports section.
:\>radare2 -w jmpesp.exe
-- The door is everything ...
[0x00401000]> e io.cache = true
[0x00401000]> e io.cache.write =true
[0x00401000]> e io.cache.read = true
[0x00401000]> S
[00:00] * pa=0x00000200 mr-x va=0x00401000 sz=0x0200 vsz=0x1000 .text
[00:01] . pa=0x00000400 mr-- va=0x00402000 sz=0x0200 vsz=0x1000 .rdata
[0x00401000]> S 0x600 0x403000 0x200 0x1000 .what rwx
[0x00401000]> S
[00:00] * pa=0x00000200 mr-x va=0x00401000 sz=0x0200 vsz=0x1000 .text
[00:01] . pa=0x00000400 mr-- va=0x00402000 sz=0x0200 vsz=0x1000 .rdata
[-1:02] . pa=0x00000600 -rwx va=0x00403000 sz=0x0200 vsz=0x1000 .what
[0x00401000]> om
6 fd: 3 +0x00000600 0x00403000 - 0x004031ff -rwx fmap..what
5 fd: 6 +0x00000000 0x00403200 - 0x00403fff -rwx mem..what
4 fd: 3 +0x00000200 0x00401000 - 0x004011ff -rwx fmap..text
3 fd: 5 +0x00000000 0x00401200 - 0x00401fff mrwx mmap..text
2 fd: 3 +0x00000400 0x00402000 - 0x004021ff -rw- fmap..rdata
1 fd: 4 +0x00000000 0x00402200 - 0x00402fff mrw- mmap..rdata
[0x00401000]> wci
[0x00401000]> S
[00:00] * pa=0x00000200 mr-x va=0x00401000 sz=0x0200 vsz=0x1000 .text
[00:01] . pa=0x00000400 mr-- va=0x00402000 sz=0x0200 vsz=0x1000 .rdata
[-1:02] . pa=0x00000600 -rwx va=0x00403000 sz=0x0200 vsz=0x1000 .what
[0x00401000]>
and quitting and reopening doesn't show the new Section
[0x00401000]> q
:\>radare2 -w jmpesp.exe
-- *(ut64*)buffer ought to be illegal
[0x00401000]> S
[00:00] * pa=0x00000200 mr-x va=0x00401000 sz=0x0200 vsz=0x1000 .text
[00:01] . pa=0x00000400 mr-- va=0x00402000 sz=0x0200 vsz=0x1000 .rdata
[0x00401000]>