Skip to main content
5 votes
Accepted

Replace section inside ELF file

I'm not aware of any ready-made tools for such task, but I suspect in most cases the good old dd will do the task of replacing the actual bytes in the file (or maybe you can make objcopy work too). ...
Igor Skochinsky's user avatar
  • 36.8k
5 votes

Adding section. Error starting the application (0xc000007b)

blabb's answer may be right as far as it relates to what's wrong in the edited binary, but the suggestion to use a kernel debugger to find the problematic stack is way off course. For this ...
conio's user avatar
  • 672
4 votes
Accepted

How do I find out what section variables and strings are defined in?

In the following answer, I'll show you several ways to achieve what you want. I'll use different approaches to do this with radre2. First, let's create a program with a bit longer strings: $ cat ...
Megabeets's user avatar
  • 8,999
3 votes

Adding section. Error starting the application (0xc000007b)

your exe is having bound import table address at 0x248 (at the end of last section ) and cff explorer is overwriting those entries (BOUND IMPORT From kernel32.dll with timestamp 5.1.2600.0 3B7DFE0E ...
blabb's user avatar
  • 16.4k
2 votes
Accepted

Radare2 create section

Creating section does work but saving them has a long outstanding bug report. I think, not sure, I saw now the bug report has been marked fixed and closed in some version. But just tried out wci ...
blabb's user avatar
  • 16.4k
2 votes

"unknown publisher" after adding new PE section

By adding an additional section you have broken the Authenticode signature. There is a great primer about how signatures work and are validated on this blog, which says: Integrity: Each Authenticode ...
David's user avatar
  • 155
2 votes
Accepted

Code caves in arm assembly

Yeah, finally figured it out by myself. After further testing, it turns out that the problem was indeed with branching. Instead of branching in thumb state, I should have branched in arm state. The ...
Silent's user avatar
  • 164
1 vote
Accepted

How do I get the start address of the 'code section' and its size to know the end address?

Sounds like you need to read the specification, and/or a tutorial, for the PE file format. There are many such resources; here's one. Specifically, you're going to want to locate the ...
Rolf Rolles's user avatar
  • 9,198
1 vote

Does Golang's cgo now support output with .gopclntab?

I think the gopclntab section should always be present in any Go binary. Without it panic() couldn't print a stack trace. I suspect the author you are citing was mistaken about this. That being said, ...
Felix Geisendörfer's user avatar
1 vote

How to get address or symbol of the usage of a constant located in rodata?

It cannot be solved in all cases. Some string (start) is not referenced in the whole text at all, even if you turned on all optimizations. Let's see the following example. #define _FILE strrchr(...
betontalpfa's user avatar
1 vote

IDA Pro: How to change segment register value

The segment register value applies from one change point until the next or end of segment, so you don't have to set it for each function, just once per segment or a contiguous ARM or Thumb chunk is ...
Igor Skochinsky's user avatar
  • 36.8k
1 vote

How to fix Mach-O segment section to deobfuscate the binary

Executable Mach-O files use segment load commands to represent loadable/mappable memory areas. They can be further split into sections. IDA’s Mach-O loader does not use the file offset field in the ...
Igor Skochinsky's user avatar
  • 36.8k
1 vote

problem rewriting ELF binary to add an additional loadable segment

I think that if you want to inject code in an elf, the best way would be to resize your second PT LOAD where the will be your loadable data, add execution permissions and inject your code at the end ...
n4sm's user avatar
  • 63

Only top scored, non community-wiki answers of a minimum length are eligible