All Questions

Tagged with
Filter by
Sorted by
Tagged with
3
votes
2answers
483 views

Adding section. Error starting the application (0xc000007b)

I added a section to this executable external link to download the executable it is winmine from windows xp using cff explorer the only modification done to the executable is adding a section i have ...
0
votes
1answer
801 views

Adding section to PE binary using Stud_Pe

I want to be able to accurately add a section to a binary by hand, without tools. I am using Stud_Pe for adding a section to a binary. While this work, I feel it's important to be able to do this ...
1
vote
1answer
815 views

Retrieving the contents of PE file sections

I am trying to get the contents of the .text section of a file (notepad.exe) using the following code: #define SECHDROFFSET(a) ((LPVOID) ( (LPBYTE) a + \ ((...
1
vote
1answer
909 views

How to recognize PE sections containing code?

Generally, what is the criterion by which to decide whether a PE section contains code or not? Specifically, is a .text or .code section always considered to contain code? And what is the ...
7
votes
1answer
4k views

PE .rdata section contents

According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found ...
1
vote
2answers
927 views

Get the PE section address

I study an analysis paper about a trojan and there are the following assembly lines: .text:004010D0 Get_PE_section_address proc near .text:004010D0 .text:004010D0 arg_0 = dword ptr ...