Monday, 15 June 2015

c++ - Added pe executable section corrupting .text section -



c++ - Added pe executable section corrupting .text section -

i trying add together section pe executable, when add together section corrupting memory of first 40 bytes of .text section. wanted know if knows why function corrupting .text section?

when check in cff explorer offsets right including new sections. has happened repeatedly different files.

here code create added section:

int addsection(char* sectionname, dword size){ int pos = ntheader->fileheader.numberofsections; firstsection[pos].virtualaddress = align((firstsection[pos - 1].virtualaddress + firstsection[pos - 1].misc.virtualsize), ntheader->optionalheader.sectionalignment); firstsection[pos].misc.virtualsize = (size); firstsection[pos].pointertorawdata = align((firstsection[pos - 1].pointertorawdata + firstsection[pos - 1].sizeofrawdata), ntheader->optionalheader.filealignment); firstsection[pos].sizeofrawdata = align(size, ntheader->optionalheader.filealignment); firstsection[pos].numberoflinenumbers = 0; firstsection[pos].numberofrelocations = 0; firstsection[pos].pointertolinenumbers = 0; firstsection[pos].pointertorelocations = 0; ntheader->fileheader.numberofsections++; ntheader->optionalheader.sizeofimage += align(firstsection[ntheader->fileheader.numberofsections-1].misc.virtualsize, ntheader->optionalheader.sectionalignment); homecoming 0;

}

i've found solution there not plenty space @ end of section headers add together section header overwriting section straight after .text. need find out how increment header space in file can add together section header without overflow.

c++ pe

No comments:

Post a Comment