Questions tagged [section]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
2 answers
578 views

How do I get the start address of the 'code section' and its size to know the end address?

I am trying to read the binary code in the text section of an executable game file (PE) programmatically but I don't know the start address and the end address of the text section. I am using C++/...
1 vote
0 answers
91 views

What are all possible ways to add strings to the .rdata section of a Binary Executable?

I was wondering what are all the possible ways people can mess with the executable's .rdata strings ? Because I've actualy seen it .. But I do not have any idea how they do that. Some random dude made ...
3 votes
1 answer
275 views

Code caves in arm assembly

In a disassembled elf binary i found these arm thumb instructions: function0 0x002cc3a8 8079 ldrb r0, [r0, #6] 0x002cc3aa 7047 bx lr In the codecave these were the initial hex ...
1 vote
1 answer
259 views

Does Golang's cgo now support output with .gopclntab?

I read this page in which the author, Chris Siebenmann, states that binaries created using cgo will not have the gopclntab or the gosymtab sections. However, I see that on go version go1.13.15 linux/...
2 votes
1 answer
1k views

IDA Pro: How to change segment register value

For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
10 votes
2 answers
13k views

PE .rdata section contents

According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found ...
1 vote
2 answers
132 views

"unknown publisher" after adding new PE section

I'm starting to learn about reverse engineering and I'm currently encountering a problem with a game I'm trying to patch. I needed more space to insert instructions in my program so I followed the ...
0 votes
2 answers
3k views

How to get address or symbol of the usage of a constant located in rodata?

I have an elf executable. I found a string (awesome string) in my .rodata section: $ mb-readelf -p 10 a.out String dump of section '.rodata': [ 0] Hello world ... [ ab12] awesome string ......
-2 votes
1 answer
826 views

How to fix Mach-O segment section to deobfuscate the binary

When reversing a Mach-O crackme file under IDA Free and MacOS, the analysis output a log in the console window that yields warning about Mach-O segments. Loading file 'target' into database... ...
1 vote
1 answer
636 views

problem rewriting ELF binary to add an additional loadable segment

I have a problem rewriting ELF binary to add an additional loadable segment for add.c code. I have problem working with https://pdfhost.io/v/U@uP1+nCY_Compact_Control_Flow_Integerity_in_Linuxpdf.pdf ...
3 votes
1 answer
750 views

Radare2 create section

Radare2 has S* commands, that can show, delete, modify sections. Is it possible to create new section in executable file and save it?
4 votes
1 answer
2k views

How do I find out what section variables and strings are defined in?

Given a simple program like this, void main (int argc, char * argv[] ) { char * arr[] = {"foo", "bar", "baz"}; *(arr[0]) = 'F'; printf( "%s", arr[0] ); } How do I find out what section ...
4 votes
2 answers
816 views

Adding section. Error starting the application (0xc000007b)

I added a section to this executable external link to download the executable it is winmine from windows xp using cff explorer the only modification done to the executable is adding a section i have ...
1 vote
1 answer
1k views

GNU objcopy: elf to hex missing sections

I am using objcopy to convert elf to hex. When I disassemble the elf in IDA Pro, all the sections are present, but they are missing from my hex and it seems the elf headers: C:\TricoreGCC>tricore-...
3 votes
1 answer
3k views

Replace section inside ELF file

Is it possible to replace a non-code section inside an ELF file? If so, then how? Is there something I would have to consider before simply replacing the bytes by some other bytes (of course nothing ...
0 votes
1 answer
1k views

Adding section to PE binary using Stud_Pe

I want to be able to accurately add a section to a binary by hand, without tools. I am using Stud_Pe for adding a section to a binary. While this work, I feel it's important to be able to do this ...
2 votes
1 answer
2k views

Retrieving the contents of PE file sections

I am trying to get the contents of the .text section of a file (notepad.exe) using the following code: #define SECHDROFFSET(a) ((LPVOID) ( (LPBYTE) a + \ ((...
1 vote
1 answer
2k views

How to recognize PE sections containing code?

Generally, what is the criterion by which to decide whether a PE section contains code or not? Specifically, is a .text or .code section always considered to contain code? And what is the ...
1 vote
2 answers
2k views

Get the PE section address

I study an analysis paper about a trojan and there are the following assembly lines: .text:004010D0 Get_PE_section_address proc near .text:004010D0 .text:004010D0 arg_0 = dword ptr ...