All Questions
7
questions
1
vote
2
answers
134
views
"unknown publisher" after adding new PE section
I'm starting to learn about reverse engineering and I'm currently encountering a problem with a game I'm trying to patch. I needed more space to insert instructions in my program so I followed the ...
- 41
4
votes
2
answers
819
views
Adding section. Error starting the application (0xc000007b)
I added a section to this executable
external link to download the executable it is winmine from windows xp
using cff explorer
the only modification done to the executable is adding a section
i have ...
- 141
0
votes
1
answer
1k
views
Adding section to PE binary using Stud_Pe
I want to be able to accurately add a section to a binary by hand, without tools.
I am using Stud_Pe for adding a section to a binary. While this work, I feel it's important to be able to do this ...
- 793
2
votes
1
answer
2k
views
Retrieving the contents of PE file sections
I am trying to get the contents of the .text section of a file (notepad.exe) using the following code:
#define SECHDROFFSET(a) ((LPVOID) ( (LPBYTE) a + \
((...
- 153
1
vote
1
answer
2k
views
How to recognize PE sections containing code?
Generally, what is the criterion by which to decide whether a PE section contains code or not?
Specifically, is a .text or .code section always considered to contain code? And what is the ...
- 113
10
votes
2
answers
13k
views
PE .rdata section contents
According to MSDN, the .rdata section of a PE should contain the debug directory and the description string. I've read elsewhere that it contains read-only program data. Dumping several files, I found ...
- 103
1
vote
2
answers
2k
views
Get the PE section address
I study an analysis paper about a trojan and there are the following assembly lines:
.text:004010D0 Get_PE_section_address proc near
.text:004010D0
.text:004010D0 arg_0 = dword ptr ...
- 1,541