flat assembler
Message board for the users of flat assembler.

Index > Windows > Easy way of adding new section to a pe file ??????

Goto page 1, 2  Next
Author
Thread Post new topic Reply to topic
shism2



Joined: 14 Sep 2005
Posts: 248
shism2
Does anyone have any fasm examples of adding a section to a pe file.
Post 12 Oct 2005, 18:20
View user's profile Send private message Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4633
Location: Argentina
LocoDelAssembly
http://flatassembler.net/examples/quetannon.zip <- Here there is an example of a program using winsock and this program defines sections. That was that you are looking for?
Post 12 Oct 2005, 18:29
View user's profile Send private message Reply with quote
shism2



Joined: 14 Sep 2005
Posts: 248
shism2
no. I want to add a new section to ANOTHER executable.
Post 12 Oct 2005, 18:43
View user's profile Send private message Reply with quote
Reverend



Joined: 24 Aug 2004
Posts: 408
Location: Poland
Reverend
What you must do:
- go to PEHeader
- get NumberOfSections (or sth like this) from PEHeader.FileHeader
- increase that number as you want to add one section
- get SizeOfOptionalHeader from PEHeader.FileHeader
- go to address that equals: PEHeader + SizeOfOptionalHeader + sizeof.IMAGE_FILE_HEADER + 4
- you're on first section structure
- add NumberOfSections * sizeof.IMAGE_SECTION_HEADER to current offset and there's the place for you to put your section attributes

Although sometimes there's no place there Smile because program has so big DOS header or whatever so that strictly after the last existing section there's program's code. So beware and try to avoid such situations
Post 12 Oct 2005, 20:47
View user's profile Send private message Visit poster's website Reply with quote
shism2



Joined: 14 Sep 2005
Posts: 248
shism2
Code:
macro   m2m     dest,src 
{ 
        push    src 
        pop     dest 
} 



;--------------------- Strings

problem db " File Error",0
error db "Error",0
protected db "File has been protected",0
protected1 db "Protected",0
sName db "shism",0
;------------ data
hFile dd 0
fsize dd 0
temp dd 0
memptr dd 0
nthdr     IMAGE_NT_HEADERS
hSection dd 0
proc ProtectFile LPSTR, hWnd
        
        invoke CreateFile,[LPSTR],GENERIC_WRITE + GENERIC_READ,FILE_SHARE_WRITE + FILE_SHARE_READ,\
                           NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0
        cmp eax,INVALID_HANDLE_VALUE
        jz peError@
        mov [hFile],eax
        
        invoke GetFileSize,[hFile],0
        cmp eax,0
        jz peError@
        mov [fsize],eax
        
         invoke CreateFileMapping,[hFile],0,PAGE_READWRITE,0,0,0
    test eax, eax
    jz peError@
        mov [temp],eax
        
        
          invoke MapViewOfFile,[temp],FILE_MAP_ALL_ACCESS,0,0,0
          test eax, eax
          jz peError@
          mov [memptr], eax
          
        mov esi, eax
    add esi, dword [esi+03ch]
    mov edi, nthdr
    mov ecx,sizeof.IMAGE_NT_HEADERS
    cld
    rep movsb
        
        .if [nthdr.OptionalHeader.DataDirectory.VirtualAddress],ne,0
         mov [nthdr.OptionalHeader.DataDirectory.VirtualAddress], NULL
         mov [nthdr.OptionalHeader.DataDirectory.Size], NULL
    .endif
        
        
    ;Prepare my section struct
        invoke VirtualAlloc, NULL, sizeof.IMAGE_SECTION_HEADER, MEM_COMMIT, PAGE_READWRITE   
    mov [hSection], eax
        
         mov eax, [hSection]
    invoke lstrcpy, eax,sName
    mov eax, hSection
    
     ASSUME eax : IMAGE_SECTION_HEADER
    m2m [eax.Misc.VirtualSize], [nthdr.OptionalHeader.SectionAlignment]
    m2m [eax.SizeOfRawData], [nthdr.OptionalHeader.FileAlignment]
    m2m [eax.PointerToRawData], [fsize]
    m2m [eax.VirtualAddress], [nthdr.OptionalHeader.SizeOfImage]
    mov [eax.Characteristics], 20000060h ;<-- code/read/execute
    
        ret
        endp
        
        peError@:
        invoke MessageBox, NULL,problem,error, MB_ICONSTOP
        invoke  CloseHandle,[memptr]
        
        protected@:
        invoke MessageBox,NULL,protected,protected1,0
            


This is some code , that I converted from masm to fasm ( by comrade)..

I get these errors

ASSUME eax : IMAGE_SECTION_HEADER
error: illegal instruction.


flat assembler version 1.64
C:\WinAsm\Assemblers\fasm\INCLUDE\APIA\kernel32.inc [1]:
import kernel32,\
C:\WinAsm\Assemblers\fasm\INCLUDE\macro/import32.inc [50] import [22]:
label dd RVA _label
error: symbol already defined.


And another problem with the macro saying .. Illegal opperand.


need some help here Wink
Post 15 Oct 2005, 01:06
View user's profile Send private message Reply with quote
Ancient One



Joined: 28 Feb 2005
Posts: 55
Ancient One
ASSUME eax : IMAGE_SECTION_HEADER

is MASM specific. remove this line and change code that use eax. with eax + IMAGE_SECTION_HEADER.
Post 15 Oct 2005, 02:27
View user's profile Send private message MSN Messenger Reply with quote
shism2



Joined: 14 Sep 2005
Posts: 248
shism2
I now get out of memory.......I even assigned 100 mb to fasm and still out of memory..

I did restart my computer and nothing...
Post 15 Oct 2005, 03:38
View user's profile Send private message Reply with quote
Reverend



Joined: 24 Aug 2004
Posts: 408
Location: Poland
Reverend
Change it like this:
Code:
;    ASSUME eax : IMAGE_SECTION_HEADER
    m2m [eax+IMAGE_SECTION_HEADER.Misc.VirtualSize], [nthdr.OptionalHeader.SectionAlignment]
    m2m [eax+IMAGE_SECTION_HEADER.SizeOfRawData], [nthdr.OptionalHeader.FileAlignment]
    m2m [eax+IMAGE_SECTION_HEADER.PointerToRawData], [fsize]
    m2m [eax+IMAGE_SECTION_HEADER.VirtualAddress], [nthdr.OptionalHeader.SizeOfImage]
    mov [eax+IMAGE_SECTION_HEADER.Characteristics], 20000060h ;<-- code/read/execute
    
Post 15 Oct 2005, 12:07
View user's profile Send private message Visit poster's website Reply with quote
Tomasz Grysztar



Joined: 16 Jun 2003
Posts: 7783
Location: Kraków, Poland
Tomasz Grysztar
You can also use this macro to make your original code assembly without problems:
Code:
macro ASSUME expr
{ match reg:struc, expr \{
   local ..label
   virtual at reg
   reg equ ..label
   reg struc
   restore reg
   end virtual
\} }    

(but note you also need to have IMAGE_SECTION_HEADER structure definition, as I recall it's not yet in the official includes)
Post 15 Oct 2005, 13:34
View user's profile Send private message Visit poster's website Reply with quote
JMGK



Joined: 26 Aug 2005
Posts: 27
JMGK
bah,

on new section:
* VirtualSize must be your code size aligned to SectionAlign, not just SectionAlign (your added code can be more than 1000h)
* SizeofRawData must be your code size, not just FileAlign (your added code can be more than 1000h)
* PointerToRawData must be previous section´s SizeOfRawData+PointerToRawData aligned to FileAlign (files can have overlays)
* VirtualAddress must be previous section´s VirtualAddress+VirtualSize aligned to SectionAlign (SizeOfImage is sometimes bad calculated)

if you want code a virus (coz it look so), check some virus source code to see how they do

jmgk

ps: i am amazed how nobody complain about the fact shism2 is clearly trying to code a virus (or what else can be?)
Post 15 Oct 2005, 15:57
View user's profile Send private message Reply with quote
Tomasz Grysztar



Joined: 16 Jun 2003
Posts: 7783
Location: Kraków, Poland
Tomasz Grysztar
Quote:

ps: i am amazed how nobody complain about the fact shism2 is clearly trying to code a virus (or what else can be?)

Even though the most probably you're right, there really are some other applications for inserting a new section - for example adding resources to the executable that doesn't have one (some resource linkers are able to do it), or adding other kind of custom information.
Post 15 Oct 2005, 16:32
View user's profile Send private message Visit poster's website Reply with quote
shism2



Joined: 14 Sep 2005
Posts: 248
shism2
Quote:

This is some code , that I converted from masm to fasm ( by comrade)..


He is a known virus writer....


Last edited by shism2 on 15 Oct 2005, 16:39; edited 1 time in total
Post 15 Oct 2005, 16:35
View user's profile Send private message Reply with quote
shism2



Joined: 14 Sep 2005
Posts: 248
shism2
Tomasz ... I'm still recieving the problem with compiling. I get out of memory problem.
Post 15 Oct 2005, 16:39
View user's profile Send private message Reply with quote
comrade



Joined: 16 Jun 2003
Posts: 1137
Location: Russian Federation
comrade
Quote:
He is a known virus writer....

what comrade would that be? and that certainly does not look like my code...

i have several projects that add sections to PE file

reimport - adds a new section to PE file, and writes a new import table there. Command-line use:
Usage: reimport.exe <input.exe> <output.exe> <hook.dll> <library::procedure> ...

For example, if you run:
reimport.exe game.exe newgame.exe nocd.dll kernel32::GetDriveTypeA kernel32::CreateFileA kernel32::GetVolumeInformation

This will create a copy of game.exe into newgame.exe, with the above 3 API functions rerouted to nocd.dll, instead of kernel32.exe. That means newgame.exe would import GetDriveTypeA, CreateFileA, and GetVolumeInformation from nocd.dll instead of kernel32.

patch - adds a new section to PE file, sets it as new entrypoint. the code in the new section loads a DLL file, and then jumps to original entrypoint. Command-line:
Usage: patch.exe <input.exe> <output.exe> <loader.dll>

A new file called output.exe will be created, which will be the same as input.exe, except it will contain a new code section which will load loader.dll before it jumps to original entrypoint. This is a way to inject a DLL into a process before it runs, the hard-way. For other ways to inject a DLL, see http://board.flatassembler.net/topic.php?p=30001#30001.


Description: September 6th, 2005
Download
Filename: patch.rar
Filesize: 12.93 KB
Downloaded: 210 Time(s)

Description: March 13th, 2004
Download
Filename: reimport.zip
Filesize: 16.17 KB
Downloaded: 181 Time(s)


_________________
comrade (comrade64@live.com; http://comrade.ownz.com/)
Post 15 Oct 2005, 17:44
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
shism2



Joined: 14 Sep 2005
Posts: 248
shism2
I guess a different one
Post 15 Oct 2005, 17:57
View user's profile Send private message Reply with quote
comrade



Joined: 16 Jun 2003
Posts: 1137
Location: Russian Federation
comrade
show me
Post 15 Oct 2005, 17:58
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
shism2



Joined: 14 Sep 2005
Posts: 248
shism2
ok gimme few secs to find him

http://nonenone.cjb.net/
Post 15 Oct 2005, 18:04
View user's profile Send private message Reply with quote
comrade



Joined: 16 Jun 2003
Posts: 1137
Location: Russian Federation
comrade
Serbian c0mrade... cool!
Post 15 Oct 2005, 19:39
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
shism2



Joined: 14 Sep 2005
Posts: 248
shism2
lol......???
Post 15 Oct 2005, 20:00
View user's profile Send private message Reply with quote
Reverend



Joined: 24 Aug 2004
Posts: 408
Location: Poland
Reverend
comrade: patch is a great tool, nice work. But did you think of implementing a cavity search procedure, ie. searching for gaps between sections large enough to contain the attaching code? It would be nice feature imho.
Post 16 Oct 2005, 09:14
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page 1, 2  Next

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.