3

I noticed that you can't simply add an instruction in IDA. Yes, you can modify one, but not add(maybe there is such feature? Can't find it though). So I used HxD to forcibly increase the PE binary where I wanted with nops to then change the nops with what I wanted in IDA. However, I realized that screwed up all the calls and jumps that came afterwards. My question is then, how should I go on about adding instructions in a binary file? Specifically a PE one in my case. Thank you.

  • 1
    Search for some unused space, add your instructions there. My answer on this question might help you. – Guntram Blohm supports Monica Feb 2 '15 at 18:04
  • I don't have enough unused space – savram Feb 2 '15 at 18:19
  • increase the virtualSize of a section then? – Dillinur Feb 6 '15 at 13:22
2

I use Stud_Pe and I have added over 8 mb to a program using this. All you need to do is make a new .stud (sort of like adding a second .text section) and then code cave it in. Also, You shouldn't have any problems using this and then working with IDA or Olly for analysis.

http://www.cgsoftlabs.ro/studpe.html

Try it out and let me know if you get stuck with it. I can show you how to use this but it should be pretty strait forward.

1

It's not an easy task. You can consider adding your own section in the PE image where to write your code and data and then link them with the original code. Or else you could try producing an assembly file from the PE and then reassembling it into new PE image. I haven't tried the second option but I think it should be possible.

For the first one you could use LordPE. Here are links to it (here & here).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.