| View previous topic :: View next topic |
| Author |
Message |
Deine Mutter
Expert Cheater
 Reputation: 1
Joined: 05 Apr 2006
Posts: 181
|
 Posted: Thu Sep 13, 2012 10:57 am Post subject: [PE/32+] Between section table and the first section |
 |
|
Hello,
When looking at PE files in a hex editor, I often encountered some bytes between the section table and the first section, which doesn't really make sense to me. As far as I am concerned, there should be a 00-byte padding in order to fit the alignment. However, here is a screenshot which shows the opposite:
As you can see, the .text section starts at offset 0x400 and the highlighted block after the last section header is the one i don't know what it is used for. Filling this block with 00s destroys the executable (cannot start anymore). By examining the destroyed exe with LordPE, it turned out there are no differences at all.
What did i overlook?
[EDIT]
It seems like this block is related to the Bound Import Directory. However, i still don't get the location. I thought everything needs to be located in a section.
_________________
|
|
| Back to top |
|
 |
n0 m3rcY
Cheater
![]() Reputation: 0
Joined: 18 Jun 2012
Posts: 42
|
| Posted: Thu Sep 13, 2012 4:08 pm Post subject: |
|
|
That is the .idata section, or import table.
|
|
| Back to top |
|
|
Deine Mutter
Expert Cheater
Reputation: 1
Joined: 05 Apr 2006
Posts: 181
|
| Posted: Thu Sep 13, 2012 4:25 pm Post subject: |
|
|
No it is not. The import table is fine after filling the selection with 00s, since it is located somewhere else (i checked it). As already mentioned in my firs post the stuff is related to the Bound Import Table.
I just do not understand why this stuff is not located in a section. I can't find any documentation about it and the article you mentioned (not directly): http://msdn.microsoft.com/en-us/library/ms809762.aspx
doesn't help me either.
_________________
|
|
| Back to top |
|
|
n0 m3rcY
Cheater
![]() Reputation: 0
Joined: 18 Jun 2012
Posts: 42
|
| Posted: Sun Nov 18, 2012 12:27 am Post subject: |
|
|
| Deine Mutter wrote: | No it is not. The import table is fine after filling the selection with 00s, since it is located somewhere else (i checked it). As already mentioned in my firs post the stuff is related to the Bound Import Table.
I just do not understand why this stuff is not located in a section. I can't find any documentation about it and the article you mentioned (not directly): http://msdn.microsoft.com/en-us/library/ms809762.aspx
doesn't help me either. |
Open it in PEiD or something and view the different sections, it could be a wierdly placed .bss section and it's manually loading the dlls, so it stores the names in that section. Do you know what language the program was written in?
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
