Questions tagged [section]
The section tag has no usage guidance.
16
questions
1
vote
2answers
45 views
“unknown publisher” after adding new PE section
I'm starting to learn about reverse engineering and I'm currently encountering a problem with a game I'm trying to patch. I needed more space to insert instructions in my program so I followed the ...
0
votes
2answers
48 views
How to get address or symbol of the usage of a constant located in rodata?
I have an elf executable. I found a string (awesome string) in my .rodata section:
$ mb-readelf -p 10 a.out
String dump of section '.rodata':
[ 0] Hello world
...
[ ab12] awesome string
......
0
votes
0answers
36 views
What are all possible ways to add strings to the .rdata section of a Binary Executable?
I was wondering what are all the possible ways people can mess with the executable's .rdata strings ?
Because I've actualy seen it .. But I do not have any idea how they do that.
Some random dude made ...
1
vote
1answer
136 views
IDA Pro: How to change segment register value
For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
-2
votes
1answer
191 views
How to fix Mach-O segment section to deobfuscate the binary
When reversing a Mach-O crackme file under IDA Free and MacOS, the analysis output a log in the console window that yields warning about Mach-O segments.
Loading file 'target' into database...
...
0
votes
1answer
76 views
problem rewriting ELF binary to add an additional loadable segment
I have a problem rewriting ELF binary to add an additional loadable segment for add.c code.
I have problem working with https://pdfhost.io/v/U@uP1+nCY_Compact_Control_Flow_Integerity_in_Linuxpdf.pdf
...
4
votes
1answer
616 views
How do I find out what section variables and strings are defined in?
Given a simple program like this,
void main (int argc, char * argv[] ) {
char * arr[] = {"foo", "bar", "baz"};
*(arr[0]) = 'F';
printf( "%s", arr[0] );
}
How do I find out what section ...
2
votes
1answer
536 views
Radare2 create section
Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
4
votes
2answers
639 views
Adding section. Error starting the application (0xc000007b)
I added a section to this executable
external link to download the executable it is winmine from windows xp
using cff explorer
the only modification done to the executable is adding a section
i have ...
1
vote
1answer
1k views
GNU objcopy: elf to hex missing sections
I am using objcopy to convert elf to hex. When I disassemble the elf in IDA Pro, all the sections are present, but they are missing from my hex and it seems the elf headers:
C:\TricoreGCC>tricore-...
3
votes
1answer
1k views
Replace section inside ELF file
Is it possible to replace a non-code section inside an ELF file? If so, then how? Is there something I would have to consider before simply replacing the bytes by some other bytes (of course nothing ...
1
vote
1answer
971 views
Adding section to PE binary using Stud_Pe
I want to be able to accurately add a section to a binary by hand, without tools.
I am using Stud_Pe for adding a section to a binary. While this work, I feel it's important to be able to do this ...
1
vote
1answer
1k views
Retrieving the contents of PE file sections
I am trying to get the contents of the .text section of a file (notepad.exe) using the following code:
#define SECHDROFFSET(a) ((LPVOID) ( (LPBYTE) a + \
((...
2
votes
1answer
1k views
How to recognize PE sections containing code?
Generally, what is the criterion by which to decide whether a PE section contains code or not?
Specifically, is a .text or .code section always considered to contain code? And what is the ...
9
votes
2answers
7k views
PE .rdata section contents
According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found ...
1
vote
2answers
1k views
Get the PE section address
I study an analysis paper about a trojan and there are the following assembly lines:
.text:004010D0 Get_PE_section_address proc near
.text:004010D0
.text:004010D0 arg_0 = dword ptr ...
