Hot answers tagged

10

It is customary for read-only data of all kinds to be lumped into .rdata. However, that's a matter of expedience, not necessity. Compiler and linker can put any data anywhere they like, as long as it is referenced correctly in the data directory. The first point of call should be Microsoft's PE COFF specification (currently v8.3). Remarks and pointers ...


6

As per the comments above, the SECHDROFFSET() macro formula is not reliable. You should instead use the macro IMAGE_FIRST_SECTION().


5

blabb's answer may be right as far as it relates to what's wrong in the edited binary, but the suggestion to use a kernel debugger to find the problematic stack is way off course. For this demonstration I use Windows XP rather than 7 like you. The effects are pretty much the same except that the NTSTATUS on XP is 0xC0000135 rather than 0xC000007B. We open ...


5

Specifically, is a .text or .code section always considered to contain code? No. And what is the relationship between the IMAGE_SCN_CNT_CODE flag (0x00000020) and IMAGE_SCN_MEM_EXECUTE flag (0x20000000) The former is ignored by the Windows PE loader. The latter is used by the Windows PE loader such that if the flag is set then the pages for that section ...


4

Calling this function Get_PE_section_address is rather misleading since it doesn't generically get "the address of a PE section", but rather is used to get the virtual address of the Section Table entry for the first section with a 0x00 as the 5th byte of its section name, iterating through sections backwards starting from the second-to-last section. So for ...


4

In the following answer, I'll show you several ways to achieve what you want. I'll use different approaches to do this with radre2. First, let's create a program with a bit longer strings: $ cat helloworld.c #include <stdio.h> void main (int argc, char * argv[] ) { char * arr[] = {"Hello", "World", "Byebye"}; arr[0] = "F"; printf( "%s\...


4

I'm not aware of any ready-made tools for such task, but I suspect in most cases the good old dd will do the task of replacing the actual bytes in the file (or maybe you can make objcopy work too). What can be more difficult is making the code work with the changed data. This depends on the nature of the data in question. For example: When replacing (...


3

your exe is having bound import table address at 0x248 (at the end of last section ) and cff explorer is overwriting those entries (BOUND IMPORT From kernel32.dll with timestamp 5.1.2600.0 3B7DFE0E (18th August 2001) 926,720 Windows XP that is why it is crashing dumpbin /headers Winmine_test.exe | grep -i bound 248 [ A8] RVA [...


Only top voted, non community-wiki answers of a minimum length are eligible