Hot answers tagged

10

It is customary for read-only data of all kinds to be lumped into .rdata. However, that's a matter of expedience, not necessity. Compiler and linker can put any data anywhere they like, as long as it is referenced correctly in the data directory. The first point of call should be Microsoft's PE COFF specification (currently v8.3). Remarks and pointers ...


6

As per the comments above, the SECHDROFFSET() macro formula is not reliable. You should instead use the macro IMAGE_FIRST_SECTION().


5

I'm not aware of any ready-made tools for such task, but I suspect in most cases the good old dd will do the task of replacing the actual bytes in the file (or maybe you can make objcopy work too). What can be more difficult is making the code work with the changed data. This depends on the nature of the data in question. For example: When replacing (...


5

blabb's answer may be right as far as it relates to what's wrong in the edited binary, but the suggestion to use a kernel debugger to find the problematic stack is way off course. For this demonstration I use Windows XP rather than 7 like you. The effects are pretty much the same except that the NTSTATUS on XP is 0xC0000135 rather than 0xC000007B. We open ...


5

Specifically, is a .text or .code section always considered to contain code? No. And what is the relationship between the IMAGE_SCN_CNT_CODE flag (0x00000020) and IMAGE_SCN_MEM_EXECUTE flag (0x20000000) The former is ignored by the Windows PE loader. The latter is used by the Windows PE loader such that if the flag is set then the pages for that section ...


4

Calling this function Get_PE_section_address is rather misleading since it doesn't generically get "the address of a PE section", but rather is used to get the virtual address of the Section Table entry for the first section with a 0x00 as the 5th byte of its section name, iterating through sections backwards starting from the second-to-last section. So for ...


4

In the following answer, I'll show you several ways to achieve what you want. I'll use different approaches to do this with radre2. First, let's create a program with a bit longer strings: $ cat helloworld.c #include <stdio.h> void main (int argc, char * argv[] ) { char * arr[] = {"Hello", "World", "Byebye"}; arr[0] = "F"; printf( "%s\...


3

your exe is having bound import table address at 0x248 (at the end of last section ) and cff explorer is overwriting those entries (BOUND IMPORT From kernel32.dll with timestamp 5.1.2600.0 3B7DFE0E (18th August 2001) 926,720 Windows XP that is why it is crashing dumpbin /headers Winmine_test.exe | grep -i bound 248 [ A8] RVA [...


2

Creating section does work but saving them has a long outstanding bug report. I think, not sure, I saw now the bug report has been marked fixed and closed in some version. But just tried out wci command and I didn't see the Newsection written out to file in disk so maybe you should pursue the issue in Radare's reports section. :\>radare2 -w jmpesp....


1

It cannot be solved in all cases. Some string (start) is not referenced in the whole text at all, even if you turned on all optimizations. Let's see the following example. #define _FILE strrchr(__FILE__, '/') ? strrchr(__FILE__, '/') + 1 : __FILE__ _FILE will point the filename instead of the full path, however, the compiled elf will contain the whole ...


1

Executable Mach-O files use segment load commands to represent loadable/mappable memory areas. They can be further split into sections. IDA’s Mach-O loader does not use the file offset field in the section headers. The data from file is loaded into database only using segment headers and then split into sections based on the address fields of the section ...


1

I think that if you want to inject code in an elf, the best way would be to resize your second PT LOAD where the will be your loadable data, add execution permissions and inject your code at the end of the data in order to hook your elf and, at the end of this "stub" jump at the original entry point. If you want to have an example, you can look at the code ...


Only top voted, non community-wiki answers of a minimum length are eligible