View Single Post
  #13  
Old 02-11-2004, 20:02
Satyric0n
 
Posts: n/a
All of the sections up until 2EA000 were created by the Delphi compiler, so I would leave them there (remember that data morphing? Delphi is probably filling those sections with data in memory).

But, since they're not holding anything physically on disk (and are essentially just wasting space, as you noted), what you can do is leave the section headers in the PE header, delete their physical storage in the file (such that RSize is 0), and set their RSize to 0 in the section header. This way they do not take up any physical size on disk, but still exist in memory when the app runs (consuming VSize KB in memory) so the Delphi code can access them like it needs to.

The good news is, you dont have to do this yourself. A good PE Rebuild process (like the one in PE Tools) will detect that a section is all 00s, and do this exact thing for you. So leave those alone, and since it is best to do a Rebuild PE once you're done editing the file anyway, just let PE Tools do all the work. The only sections you need to worry about are the ones after .rsrc.

But I'm glad you brought this up, it shows that you are thinking about what you're doing, and not just blindly following someone else's tutorial/instructions.

FYI, those sections are:
Code:
001000 CODE
214000 DATA
226000 BSS
22A000 .idata (original, but ruined by ASPR, import table)
22E000 ?? -- either this is .tls
22F000 ?? -- or this is .tls, I'm not sure which
230000 .rdata
231000 .reloc
252000 .rsrc
2EA000 .data -- this section is named randomly by ASProtect, and holds ASPR's IAT, some redirected resources, etc
312000 .adata -- this section is used as in-memory data storage by ASPR
313000 .mackt -- as you said, holds the new IAT created by ImpRec
Regards,
Satyric0n

Last edited by Satyric0n; 02-11-2004 at 20:14.
Reply With Quote