I was wonder if it is possible to add a new code section (Similar to .text) to a .exe file and add executable code to it?

Can I make a jump from a section to another using 0xE9 opcode (Or maybe 0xEA?)?

For example if I put (0x66 0xE9 <4 byte address little-endian starting from next instruction>) in the start of .text

Do I need to make the JMP to the virtual address of the section (Once its loaded to memory)?

Or physical address (Address in hard disk)?

AssemblerX86

Quote:

I was wonder if it is possible to add a new code section (Similar to .text) to a .exe file and add executable code to it?

Yes, in most cases it is. You only need to put the new section header at the end of the headers region, add new section data at the end of the executable, and fix some fields of the PE header and optional header: NumberOfSections, SizeOfCode, SizeOfImage and Checksum.

In some cases there are pitfalls, such as an overlay (each such case should be treated and analyzed individually), or no space for a new section header (the headers size can then be extended, but this would shift the file offsets of sections and therefore requires the executable to have relocations for proper modification), or a data directory inside the headers region could be using the space for the new section header. A cryptographic signature in a PE is in most cases not a problem, cause its verification is normally enforced only for some types of 32-bit drivers and for 64-bit drivers. This is provided the executable does not have its own internal integrity checks.

Quote:

Can I make a jump from a section to another using 0xE9 opcode (Or maybe 0xEA?)?

Yes, you can use both, but the former is more robust as it's base independent. $EA would require you to add a fixup entry for the offset part of the logical address inside the instruction. This instruction is normally not used in applications, cause there's normally only one accessible code segment.

Quote:

For example if I put (0x66 0xE9 <4 byte address little-endian starting from next instruction>) in the start of .text

The prefix $66 limits the immediate offset and the destination address to 2 bytes. You end up jumping into the unallocated region between 0 and $FFFF (unless you deliberately allocate virtual space there).

Quote:

Do I need to make the JMP to the virtual address of the section (Once its loaded to memory)?

Yes. The CPU executes your jump directly by knowing only the current virtual address and the instruction opcode: it doesn't go read files from the hard drive to find the destination address.

Quote:

Or physical address (Address in hard disk)?

It's called file offset. "Physical address" is a different unrelated concept.

What do you mean 0x66 limits the immediate offset to 2 bytes? Doesn't it make it DWORD (4 bytes) address rather than WORD?

I have done all of this, yet the executable crashes when I start it

I am calculating the virtual address using this equation:

What if the code in that section requires data from .data?

And by the way, the Checksum is set to 0x0000, what do I have to change in it?

format binary as "dll"

IDH.e_lfanew                    equ 3Ch
sizeof.Signature                equ 4h
sizeof.FileHeader               equ 14h
IOH.CheckSum                    equ 40h


PEFile: file "%WinDir%\system32\user32.dll"
PESize = $-PEFile

load PEHeader dword from PEFile + IDH.e_lfanew
PEHeader = PEFile + PEHeader

PEOptionalHeader = PEHeader + sizeof.Signature + sizeof.FileHeader

;set the checksum field to zero
store dword 0 at PEOptionalHeader + IOH.CheckSum

newCheckSum = 0
repeat PESize/4
        load buf dword from (%-1)*4
        newCheckSum = (newCheckSum + buf) and 0FFFFFFFFh + (newCheckSum + buf) shr 32
end repeat
newCheckSum = (newCheckSum shr 16) + (newCheckSum and 0FFFFh)
newCheckSum = newCheckSum and 0FFFFh + newCheckSum shr 16 + PESize

store dword newCheckSum at PEOptionalHeader + IOH.CheckSum