View previous topic :: View next topic |
Author |
Message |
ulysse31 Master Cheater Reputation: 2
Joined: 19 Mar 2015 Posts: 324 Location: Paris
|
Posted: Thu Feb 09, 2017 6:27 pm Post subject: Resize Section of dll |
|
|
Hello, I am having trouble resizing the section of a DLL. I use LordPe to edit the dll, I go in the sections part of lordpe, i chose the last section and I increase the Raw size and the virtual size by 1000.
Then i adjust the SizeofImage.
However when i try to hexedit the dll from disk I can see it doesn't have more memory space (as I would have assumed that increasing the raw size by 1000 would give me another 1000 bytes on disk). Have tried to play with values and googled around but didn't find anything, probably just a handful of values i need to adjust..
|
|
Back to top |
|
|
Dark Byte Site Admin Reputation: 458
Joined: 09 May 2003 Posts: 25295 Location: The netherlands
|
Posted: Thu Feb 09, 2017 6:43 pm Post subject: |
|
|
you also need to increase the filesize. Try writing 1000 bytes to the end of the file (Also, just changing those fields is not enough, you may also have to shift some memory regions, and adjust relative addresses that reference addresses in other segments)
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
Back to top |
|
|
ulysse31 Master Cheater Reputation: 2
Joined: 19 Mar 2015 Posts: 324 Location: Paris
|
Posted: Thu Feb 09, 2017 7:15 pm Post subject: |
|
|
Dark Byte wrote: | you also need to increase the filesize. Try writing 1000 bytes to the end of the file |
Great, used HxD to edit size and it now works.
Dark Byte wrote: | (Also, just changing those fields is not enough, you may also have to shift some memory regions, and adjust relative addresses that reference addresses in other segments) |
That also applies when resizing the last section of the DLL (which is what i did) ? I'd have thought this mattered when inserting bytes anywhere but at the end of the file.
|
|
Back to top |
|
|
Dark Byte Site Admin Reputation: 458
Joined: 09 May 2003 Posts: 25295 Location: The netherlands
|
Posted: Thu Feb 09, 2017 7:26 pm Post subject: |
|
|
It depends on the section.
If it's a section that actually gets loaded then it's fine, but not all sections get loaded in memory. (debug info, extra data, etc...)
Although I guess if you edit the last segment that DOES get loaded in memory, then you only need to update the file address in the pe headers for the subsequent sections
(It also depends on what you write. If it's executable code, the segment has to be changed to executable as well)
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
Back to top |
|
|
atom0s Moderator Reputation: 198
Joined: 25 Jan 2006 Posts: 8517 Location: 127.0.0.1
|
Posted: Thu Mar 02, 2017 4:05 am Post subject: |
|
|
Check out CFF Explorer. It offers the ability to automatically realign the headers for you after you make any adjustments to the sections such as adding/deleting and modifying them.
After editing something, right-click somewhere in the sections and choose the options to 'Rebuild Image Size' and 'Rebuild PE Header'.
_________________
- Retired. |
|
Back to top |
|
|
|