The Raw Offset will increase based on the size of the raw offset.Raw Size, this is how much hard writable space you have.Virtual offset will be increased by the size of the virtual size.Virtual size should be greater or equal to the raw size This is space that gets allocated.Things to calculate for if you want to do this on your own. Here is an image of a header (From Stud_PE). If you really want to know, the Stud Headers are 0x28 in size so it's not too hard. So this can feel a bit tricky to do in a hex editor because hex is not easily readable by humans.

Let's jot down the last section header just because we'll need to take these numbers and add to them for the next section.

If we were adding two sections, we would make this a 6 and so forth. We will need to change this to 5 because we are adding a section. Now we need to go to the top and add to the NumberOfSections(0xF6) In this binary they're 4 sections. Just change the highlighted part to 0010 for 0x1000 This is a visual hex representation of above last section defined. Not to mention 0x1000(4096 bytes) isn't too much, but it's enough for getting a lot done. Also, this will mix up some analysis of the sections made by tools. We can, of course, add more, but it becomes slightly more complicated when you have some bytes being padded and the image being rounded out. Since this is 0x1000, we can comfortably add 0x1000(4096) bytes to this. The size value lets us know what we can what we can comfortably add regarding size as a section. Usually, and Usually, it is 0x1000 in size. Once you double click in there, you'll be redirected to the PE HEADER signified with the 'MZ' in hex.Īs I said above the SECTION_ALIGNMENT is IMAGEBASE+128. For this scenario, it's important to know because it shows kind of what we can get away with in terms adding sections and what sections should be aligned to.Ī simple way to do this is to open OllyDBG and open your binary and click the 'M' for memory map and click the section of the binary that has the PE header. RSRC If we look at the IMAGEBASE+128 to find the SECTION_ALIGNMENT Is the relocation of all the sections.

NumberOfSections usually located at 0xF6 of the IMAGEBASE Virtually. Items that we will want to have: IMAGEBASE this will usually be 00400000 The PE header will have this defined at 0x124 bytes into the header. This has to do with data that is initialized in memory at load time will need to be stored virtually. Somethings to keep in mind is that the Virtual sizes should be equal or greater to the raw size. I think dividing this like so, makes this easier to read and can provide understanding. Here is what an example stub looks like, we reverse binary because of little endian.

Change the Image Size definition in the PE Header usually at (IMAGEBASE+0x140).

Change the number of the stubs Usually at (IMAGEBASE+ 0xF6).

Round off the VIRTUAL_SIZE of the last section header to the SECTION_ALIGNMENT found in the (IMAGEBASE+0x128).

Find the IMAGEBASE Many things will hinge off of this.So the process for doing this is quite simple. Use a VM! I will be using WxHe圎ditor for making changes. The executable used in the example will be on that I have pulled from The famous R4ndom on the backup of his site As always don't do this in a production environment.

Integer overflow example