I noticed that you can't simply add an instruction in IDA. Yes, you can modify one, but not add(maybe there is such feature? Can't find it though). So I used HxD to forcibly increase the PE binary where I wanted with nops to then change the nops with what I wanted in IDA. However, I realized that screwed up all the calls and jumps that came afterwards. My question is then, how should I go on about adding instructions in a binary file? Specifically a PE one in my case. Thank you.
3
-
1Search for some unused space, add your instructions there. My answer on this question might help you.– Guntram BlohmCommented Feb 2, 2015 at 18:04
-
I don't have enough unused space– savramCommented Feb 2, 2015 at 18:19
-
increase the virtualSize of a section then?– user2823000Commented Feb 6, 2015 at 13:22
Add a comment
|
2 Answers
I use Stud_Pe and I have added over 8 mb to a program using this. All you need to do is make a new .stud (sort of like adding a second .text section) and then code cave it in. Also, You shouldn't have any problems using this and then working with IDA or Olly for analysis.
http://www.cgsoftlabs.ro/studpe.html
Try it out and let me know if you get stuck with it. I can show you how to use this but it should be pretty strait forward.
It's not an easy task. You can consider adding your own section in the PE image where to write your code and data and then link them with the original code. Or else you could try producing an assembly file from the PE and then reassembling it into new PE image. I haven't tried the second option but I think it should be possible.
For the first one you could use LordPE. Here are links to it (here & here).
