adding a pe section problem
 

Hi!!

I'm testing several apps to add a new section in its header but I have a problem.
When I add a new section in SOME APP's I have a error.
I use IIDKING, TOPO, or Snippet creator to add a new section in CALC.EXE (popular calculator from Windows XP SP1) and when I run the app I have a error msg. Only IIDKING tell me that "...has no room in its PE section header to add new sections...).
In other apps I can add new sections but in calc.exe NO :confused:

can anyone explain why and how I can do it?

Regards.

Have you tried with lordPE ?
 

If not, try it....
Or send it to me CALC.EXE cause I haven't XP_SP1 to try.
Best regards.

thanks for your reply...

yes I've tried Lord Pe too, it have not add imports function but I have used its function that let me make bigger the sizeofheader but the exe make a GPF.

I have attached the EXE file.

Regards.

LordPe has function to add imports.
PE Editor > Directories
click the "..." in the line of Import Table
add any imports you want
i don't have problems adding sections.

I'm still pretty "newbie" so I may be way off-base here, but I think I see the problem. The section table in calc.exe starts at file offset 0x1EB. Each section header is 40 (dec) bytes long. There are 3 sections, so the last byte of the section table is at offset 0x25F. If you look at the data directory, the bound import table starts at offset 0x260. So there's literally no space at the end of the section table to add another section header unless you move the bound import table further down.

After the BIT, there's a whole bunch of null bytes until you get to the first section at 0x400, so you have a little space to do that. When I tried tacking on another section using LordPE, it automatically moved the BIT to 0x288 and updated the data directory. Which I must say, is pretty slick :cool:. The BIT is only 128 bytes long, so there's more than enough room for it before hitting the first section. I don't know what LordPE does if it can't make room for the extra section headers, though. I'll have to test this some time.

to MaRKuS-DJM:

tHANK YOU, Lord PE add sections without problem, is not in a very intuitive place but it works perfectly.


to tbone:
thank you for you reply too, you're right and with your answer I understand why there's not room in the EXE.

Regards

And no thanks to LaDidi :-(
 

I'm sad....
Two thanks and nothing for me :-)
Best regards

ooopss! :eek:

sorry


BTW:you know that you have my thanks!!!

Regards