Get Yourself Acquainted with the Binary Format Two Major Formats Are
PE or COFF for Windows
ELF For Linux
A Windows PE Section Named .xyz might have the following properties
SECTION HEADER #1
15 virtual size
1000 virtual address (00401000 to 00401014)
200 size of raw data
200 file pointer to raw data (00000200 to 000003FF)
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
a Section is normally Aligned on a 0x200 bytes in the physical binary
a Section is normally mapped with an alignment of 0x1000 by the windows loader when you execute the binary
this space of either
( sizeof(RawData) - sizeof(VirtualSize) ) or
( sizeof(PageSize) - sizeof(VirtualSize) )
is inherently available for Manipulation
in the section header above you either have physical and permanent modifiable space of
:\>python -c print(hex(0x200-0x15))
or a transient temporarily modifiable space of
:\>python -c print(hex(0x1000-0x15))
just as confirmation you can dump 50 bytes from this .xyz section
which is located at 0x200 in the physical file and
Notice after the VirtualSize of 0x15 it is filled with 0x00 (NULLS) upto 0x400 (The File Alignment Size)
:\>xxd -s 0x200 -l 0x50 -g 0x16 winmsgbox.exe
00000200: 558bec6a006a006a006a00ff15002040 U..j.j.j.j.... @
00000210: 005dc210000000000000000000000000 .]..............
00000220: 00000000000000000000000000000000 ................
00000230: 00000000000000000000000000000000 ................
00000240: 00000000000000000000000000000000 ................
0x215 to 0x3ff is free in the section shown above
:\>xxd -s 0x3f0 -l 0x20 -g 0x16 winmsgbox.exe
000003f0: 00000000000000000000000000000000 ................
00000400: fc200000000000000000000000000000 . ..............
since this section is already an Executable Section you can add your code in this Section and execute it without worrying about Page Protection Limitations enforced by the system.
you can either physically modify the binary using a hex editor up to 0x1eb bytes
patch it in Memory up to 0xfeb bytes
the sample code below is a simple MessageBox with no Message or Caption
compiled using vs 2017 as x86 (32bit) from which the Section Header is Displayed above
-rw-r--r-- 1 197121 130 Jun 20 19:51 complink.bat
-rw-r--r-- 1 197121 215 Jun 20 20:08 winmsgbox.cpp
#pragma comment(lib, "user32.lib")
int WINAPI WinMain(_In_ HINSTANCE, _In_opt_ HINSTANCE, _In_ LPSTR, _In_ int)
return MessageBoxW(NULL, NULL, NULL, NULL);
cl /W4 /analyze:autolog- /Od /nologo /GS- %1.cpp /link /release /ENTRY:WinMain /SUBSYSTEM:Windows /FIXED
on execution The Message box will display a caption of System Default String "Error"
think of ways and means to Change the Caption to "Success"
one possible way is to recompile it with required info rip the bytes paste and adjust
another possible way is to hexedit the strings calculate offsets and Detour
any other ways ?