adding code to kernel32.dll

[omidgl]

amigo :
I don't know what you are going to do by that change. But maybe there are some cleaner ways to do that.
If you are going to change some API behavior or execution... Then it's better to use a filter between Kernel32.dll and Ntdll.dll (Using API redirection/SPYing), so that you can take the control and do what you want to response to API calls from User-Mode programs and return them what you want. By using that method you can remove yourself at any time and take back the system behavior to its normal state.

Regards
OMID

did you try to put your code inside additional DLL file, then just load that DLL from patched kernel's code and use GetProcAddress() to read & call your code (if you need to modify something inside the kernel, pass it to your procedure as a pointer), just my 0.02$

I think the key to this problem is the OS loader. Probably OS loader limits the image size...
BART's advice is a solution maybe, if your codes don't be executed during loading.

[amigo]

Hi
Great thanks for all
I resolved the problem. I don't believe I made silly mistake as follows:
I had increased both Raw and Virtual Size, keeping Raw=Virtual.
I worked only on PE header, the file size didn't changed.
Then, the Raw Size in PE header was above EOF(.
This caused the error .
After adding some nullz to the EOF all is OK.
I added new section after last original, .reloc. There's 3000 h free space between kernel32 and ntdll images (XP SP1), so I create new section 3000h of size.This is enough for my code.
.
Of course, Omidgl, I can explain what I'm doing.
It write some kind of universal antiviral protection.
I add my code to some procs (CreateProcess, CreateService etc)
My code check the name of starting process/service and its properties (size, checksum) with the list. When the starting process is not present on the list, the messagebox appears :" Do you want to start CIH.exe, image size..., created .... ?".
If answer is not, it writes 0 as a first byte of path, so the system message 'can't find the file' appears .
Ye, I know, it's a little lame.....

Regards
amigo

Originally Posted by amigo

Of course, Omidgl, I can explain what I'm doing.
It write some kind of universal antiviral protection.
I add my code to some procs (CreateProcess, CreateService etc)
My code check the name of starting process/service and its properties (size, checksum) with the list. When the starting process is not present on the list, the messagebox appears :" Do you want to start CIH.exe, image size..., created .... ?".
If answer is not, it writes 0 as a first byte of path, so the system message 'can't find the file' appears .
Ye, I know, it's a little lame.....
Regards
amigo

For this kind of global hooks you'd be better using ntdll/ntoskrnl and native api interception... Any program not using win32 functions would escape your protection.