How to add a section In an EXE
 

I don't know how to explain it detailedly ,just like this:

0001: PUSH EAX
0002: DEC EDI
0003: INC EBP
.
.
I want this:

0001: PUSH EAX
0002: JMP 0008
0003: INC EBP
.
.
.
0008: NOP
0009: DEC EDI
0010: JMP 0003

============================

Begin 0008 is the added section, use PEeditor can add a section, someone told me it needs change the ImageSize at the same time,PEeditor also can do this. But I failed.When I use OllyDbg open it , I was told it's not a valid EXE file.

Thank you very much for guidance.

Adding Section
 

You can use Code Snippet Creator for that (you can find it on programmer's tools site)

adding a section is a very simple task with lordpe.
when you add a new section in a exe you should control the following things:
1) section do not overlap
2) the virtual size of each section must fill entirely the range between one
section and the other.
Lordpe is a very useful tool as it can do it automatically.
In particular it can be forced to do the step 2) with the option recontruct pe.
you can post the new section header table so i can show you where the problem is (grab the section header with lordpe or some other tool).

Thanks LOUZEW , Code Snippet Creator is a good tool but it's a little difficulty for me, it needs MASM environment first.

Thanks zaratustra , I may need your further help.

What I want in my attached file , this is the first step. Maybe I understand how to do this then I can go to next step...

Big thanks. :)

Q1 : VirtualSize is the size which is occupied by the section when this is loaded in RAM.

Q2 : RawSize is the size which is occupied by the section on the HD.

Q3 : When you attribue some value at the VirtualSize of a section, SizeOfImage, which is the VirtualSize of the whole exe when loaded in RAM, will be automatically update.

I hope this can help you...

Thanks Michel that would be my answer too.
Only a note :
if you add a new section, to obtain a valid pe (which olly can see)
you have to adjust the size of the previous section.
In the image you have posted you should also set the vsize of the .rsrc section to
10000 - a000

cheers
z.

Do you think it's really necessary ?
Look that 65CA != 8000 - 1000 (sec .text)

Thank you Michel and zaratustra.I know the theory more than before. ;)

But I was puzzled about what size and where I should fill in.

See the attached file.

I change the value twice for each place. But the Notepad.exe both could not run.


Maybe I'm thickheaded :mad: So could you please use Interkodex Screen Recorder to make avi for a simple sample if convenience ? Not necessary if inconvenience.

Notepad has an 'irregular' PE Header format. I will explain it later.
Please have a look at another exe, you should note that my assertion
about the virtual size is correct. ( You can obtain the same result
with the option rebuild pe in lordpe applied to notepad).
YOU WILL OBTAIN AN ERROR IF THE VSIZE OF YOUR ADDED SECTION IS 0.
Also when you add a new section you should specify the Raw offset in the file
where your data reside. In your case, you should also add some datas at the end of file. You can do it with winhex or some other program. Or with lordpe
for example loading the section directly from disk. It is the way I prefer.
Save your datas to disk and load a new section from disk with lordpe.
Fix the vsize of the previous last section to fit the new allotted section and try...
Please try also with a program different from notepad, or post the
data of your new section I can try it on my own.
Cheers.
Z.

Thanks all.

Someone told me a simple way to do that.

Just change the Vsize Rsize and Image size with the same size. :rolleyes:

The exe ran normally. But I am not very satisfy with this way because I learnt little from it.Maybe I'm insatiable..Oh..~~~ :o