Hello guys,
I have problem, I want to add new section to PE section header automatically.
AddNewSection PROC szName:DWORD, dwSize:DWORD, Buffer:DWORD
LOCAL i:DWORD
LOCAL dwTarNum:DWORD
LOCAL dwAlignTo:DWORD
LOCAL roffset:DWORD
LOCAL rsize:DWORD
LOCAL voffset:DWORD
LOCAL vsize:DWORD
MOV ESI, Buffer
MOVZX EDX, [ESI].IMAGE_NT_HEADERS.FileHeader.NumberOfSections
MOV i, EDX
MOV EDX, [ESI].IMAGE_NT_HEADERS.OptionalHeader.FileAlignment
MOV dwAlignTo, EDX
PUSH dwAlignTo
MOV EDX, dwSize
MOV dwTarNum, EDX
PUSH dwTarNum
CALL PEAlign
MOV rsize, EAX
MOV EDX, [ESI].IMAGE_NT_HEADERS.OptionalHeader.SectionAlignment
MOV dwAlignTo, EDX
PUSH dwAlignTo
PUSH rsize
CALL PEAlign
MOV vsize, EAX
MOV EDX, [ESI].IMAGE_SECTION_HEADER[i-1].PointerToRawData + [EAX].IMAGE_SECTION_HEADE[i-1].SizeOfRawData
PUSH EDX
MOV EDX, [ESI].IMAGE_NT_HEADERS.OptionalHeader.FileAlignment
MOV dwAlignTo, EDX
PUSH dwAlignTo
CALL PEAlign
MOV roffset, EAX
MOV EDX, [ESI].IMAGE_SECTION_HEADER[i-1].VirtualAddress+[EAX].IMAGE_SECTION_HEADER[i-1].Misc.VirtualSize
MOV voffset, EDX
PUSH voffset
MOV EDX, [ESI].IMAGE_NT_HEADERS.OptionalHeader.SectionAlignment
MOV dwAlignTo, EDX
PUSH dwAlignTo
CALL PEAlign
MOV voffset, EAX
PUSH 28h
PUSH 0
LEA ECX, [ESI].IMAGE_SECTION_HEADER[i]
PUSH ECX
CALL memset
MOV EDX, roffset
MOV [ESI].IMAGE_SECTION_HEADER[i].PointerToRawData, EAX
MOV EDX, voffset
MOV [ESI].IMAGE_SECTION_HEADER[i].VirtualAddress, EDX
MOV EDX, rsize
MOV [ESI].IMAGE_SECTION_HEADER[i].SizeOfRawData, EDX
MOV EDX, vsize
MOV [ESI].IMAGE_SECTION_HEADER[i].Misc.VirtualSize, EDX
MOV [ESI].IMAGE_SECTION_HEADER[i].Characteristics, 0C0000040h
PUSH szName
CALL strlen
PUSH EAX
PUSH szName
LEA EDX, [ESI].IMAGE_SECTION_HEADER[i].Name1
PUSH EDX
CALL memcpy
PUSH rsize
PUSH 40h
CALL GlobalAlloc
MOV [ESI].IMAGE_SECTION_HEADER[i], EAX
INC [ESI].IMAGE_NT_HEADERS.FileHeader.NumberOfSections
LEA EAX, [ESI].IMAGE_SECTION_HEADER[i]
RET
AddNewSection ENDP
when I compiled theses errors showed up:
Error 8 error A2006: undefined symbol : Characteristics N:\My projects\Mal\msgVirus\msgVirus\main.asm 436 1 msgVirus
Error 12 error A2006: undefined symbol : GlobalAlloc N:\My projects\Mal\msgVirus\msgVirus\main.asm 448 1 msgVirus
Error 11 error A2006: undefined symbol : memcpy N:\My projects\Mal\msgVirus\msgVirus\main.asm 444 1 msgVirus
Error 3 error A2006: undefined symbol : memset N:\My projects\Mal\msgVirus\msgVirus\main.asm 422 1 msgVirus
Error 7 error A2006: undefined symbol : Misc N:\My projects\Mal\msgVirus\msgVirus\main.asm 434 1 msgVirus
Error 10 error A2006: undefined symbol : Name1 N:\My projects\Mal\msgVirus\msgVirus\main.asm 442 1 msgVirus
Error 1 error A2006: undefined symbol : PointerToRawData N:\My projects\Mal\msgVirus\msgVirus\main.asm 399 1 msgVirus
Error 4 error A2006: undefined symbol : PointerToRawData N:\My projects\Mal\msgVirus\msgVirus\main.asm 425 1 msgVirus
Error 6 error A2006: undefined symbol : SizeOfRawData N:\My projects\Mal\msgVirus\msgVirus\main.asm 431 1 msgVirus
Error 9 error A2006: undefined symbol : strlen N:\My projects\Mal\msgVirus\msgVirus\main.asm 439 1 msgVirus
Error 2 error A2006: undefined symbol : VirtualAddress N:\My projects\Mal\msgVirus\msgVirus\main.asm 408 1 msgVirus
Error 5 error A2006: undefined symbol : VirtualAddress N:\My projects\Mal\msgVirus\msgVirus\main.asm 428 1 msgVirus
I made my search and I found that IMAGE_SECTION_HEADER don't accept indexing "[i]".
So, how to get section by giving index from PE header? OR how to retrieve sections from PE header?