Click here to Skip to main content
15,883,751 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hello guys,
I have problem, I want to add new section to PE section header automatically.

C++
AddNewSection	PROC	szName:DWORD, dwSize:DWORD, Buffer:DWORD
	LOCAL	i:DWORD
	LOCAL	dwTarNum:DWORD
	LOCAL	dwAlignTo:DWORD
	LOCAL	roffset:DWORD
	LOCAL	rsize:DWORD
	LOCAL	voffset:DWORD
	LOCAL	vsize:DWORD

	MOV	ESI, Buffer

	MOVZX   EDX, [ESI].IMAGE_NT_HEADERS.FileHeader.NumberOfSections
	MOV     i, EDX
    
	MOV	EDX, [ESI].IMAGE_NT_HEADERS.OptionalHeader.FileAlignment
	MOV	dwAlignTo, EDX
	PUSH    dwAlignTo
	MOV	EDX, dwSize
	MOV	dwTarNum, EDX
	PUSH    dwTarNum
	CALL    PEAlign
	
	MOV     rsize, EAX

        MOV	EDX, [ESI].IMAGE_NT_HEADERS.OptionalHeader.SectionAlignment
	MOV		dwAlignTo, EDX
	PUSH    dwAlignTo
	PUSH    rsize
	CALL    PEAlign
	
	MOV     vsize, EAX
    
	MOV	EDX, [ESI].IMAGE_SECTION_HEADER[i-1].PointerToRawData + [EAX].IMAGE_SECTION_HEADE[i-1].SizeOfRawData
	PUSH    EDX
	MOV	EDX, [ESI].IMAGE_NT_HEADERS.OptionalHeader.FileAlignment
	MOV	dwAlignTo, EDX
	PUSH	dwAlignTo
	CALL    PEAlign
	
	MOV     roffset, EAX
    
	MOV	EDX, [ESI].IMAGE_SECTION_HEADER[i-1].VirtualAddress+[EAX].IMAGE_SECTION_HEADER[i-1].Misc.VirtualSize
	MOV		voffset, EDX
	PUSH	voffset
	MOV	EDX, [ESI].IMAGE_NT_HEADERS.OptionalHeader.SectionAlignment
	MOV	dwAlignTo, EDX
	PUSH	dwAlignTo
	CALL    PEAlign
	
	MOV     voffset, EAX
    
	PUSH    28h
	PUSH    0
	LEA	ECX, [ESI].IMAGE_SECTION_HEADER[i]
	PUSH	ECX
	CALL	memset

	MOV	EDX, roffset
	MOV	[ESI].IMAGE_SECTION_HEADER[i].PointerToRawData, EAX
    
	MOV	EDX, voffset
	MOV	[ESI].IMAGE_SECTION_HEADER[i].VirtualAddress, EDX
    
	MOV	EDX, rsize
	MOV	[ESI].IMAGE_SECTION_HEADER[i].SizeOfRawData, EDX
    
	MOV	EDX, vsize
	MOV	[ESI].IMAGE_SECTION_HEADER[i].Misc.VirtualSize, EDX
    
	MOV	[ESI].IMAGE_SECTION_HEADER[i].Characteristics, 0C0000040h
    
	PUSH	szName
	CALL	strlen
	PUSH	EAX
	PUSH	szName
	LEA	EDX, [ESI].IMAGE_SECTION_HEADER[i].Name1
	PUSH	EDX
	CALL    memcpy
    
	PUSH	rsize  
	PUSH    40h
	CALL    GlobalAlloc
	MOV	[ESI].IMAGE_SECTION_HEADER[i], EAX
    
	INC	[ESI].IMAGE_NT_HEADERS.FileHeader.NumberOfSections
    
	LEA	EAX, [ESI].IMAGE_SECTION_HEADER[i]
RET
AddNewSection ENDP


when I compiled theses errors showed up:
CSS
Error   8   error A2006: undefined symbol : Characteristics N:\My projects\Mal\msgVirus\msgVirus\main.asm   436 1   msgVirus
Error   12  error A2006: undefined symbol : GlobalAlloc N:\My projects\Mal\msgVirus\msgVirus\main.asm   448 1   msgVirus
Error   11  error A2006: undefined symbol : memcpy  N:\My projects\Mal\msgVirus\msgVirus\main.asm   444 1   msgVirus
Error   3   error A2006: undefined symbol : memset  N:\My projects\Mal\msgVirus\msgVirus\main.asm   422 1   msgVirus
Error   7   error A2006: undefined symbol : Misc    N:\My projects\Mal\msgVirus\msgVirus\main.asm   434 1   msgVirus
Error   10  error A2006: undefined symbol : Name1   N:\My projects\Mal\msgVirus\msgVirus\main.asm   442 1   msgVirus
Error   1   error A2006: undefined symbol : PointerToRawData    N:\My projects\Mal\msgVirus\msgVirus\main.asm   399 1   msgVirus
Error   4   error A2006: undefined symbol : PointerToRawData    N:\My projects\Mal\msgVirus\msgVirus\main.asm   425 1   msgVirus
Error   6   error A2006: undefined symbol : SizeOfRawData   N:\My projects\Mal\msgVirus\msgVirus\main.asm   431 1   msgVirus
Error   9   error A2006: undefined symbol : strlen  N:\My projects\Mal\msgVirus\msgVirus\main.asm   439 1   msgVirus
Error   2   error A2006: undefined symbol : VirtualAddress  N:\My projects\Mal\msgVirus\msgVirus\main.asm   408 1   msgVirus
Error   5   error A2006: undefined symbol : VirtualAddress  N:\My projects\Mal\msgVirus\msgVirus\main.asm   428 1   msgVirus


I made my search and I found that IMAGE_SECTION_HEADER don't accept indexing "[i]".
So, how to get section by giving index from PE header? OR how to retrieve sections from PE header?
Posted

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900