Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 12-14-2004, 15:56
zaratustra
 
Posts: n/a
Quote:
Originally Posted by Michel
Do you think it's really necessary ?
Look that 65CA != 8000 - 1000 (sec .text)



Notepad has an 'irregular' PE Header format. I will explain it later.
Please have a look at another exe, you should note that my assertion
about the virtual size is correct. ( You can obtain the same result
with the option rebuild pe in lordpe applied to notepad).
YOU WILL OBTAIN AN ERROR IF THE VSIZE OF YOUR ADDED SECTION IS 0.
Also when you add a new section you should specify the Raw offset in the file
where your data reside. In your case, you should also add some datas at the end of file. You can do it with winhex or some other program. Or with lordpe
for example loading the section directly from disk. It is the way I prefer.
Save your datas to disk and load a new section from disk with lordpe.
Fix the vsize of the previous last section to fit the new allotted section and try...
Please try also with a program different from notepad, or post the
data of your new section I can try it on my own.
Cheers.
Z.

Last edited by zaratustra; 12-14-2004 at 16:09.
Reply With Quote
  #2  
Old 12-18-2004, 11:22
netxman
 
Posts: n/a
Thanks all.

Someone told me a simple way to do that.

Just change the Vsize Rsize and Image size with the same size.

The exe ran normally. But I am not very satisfy with this way because I learnt little from it.Maybe I'm insatiable..Oh..~~~
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
chinese Section Utshiha General Discussion 6 02-02-2015 21:32


All times are GMT +8. The time now is 01:46.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )