PE File section relocation and stack cookies -> Error
up vote
0
down vote
favorite
i'm trying to increase the size of a pe section which is located after the .text section. I want to increase the size of .rdata by 0x1000 to go from this layout
to that layout
by adding 0x1000 as an offset k to the section size.
What am i doing to achieve this:
- Adding extra size/offset (k) to the "VirtualSize" property of the pe file
- Adding the offset k to all "VirtualAddress" properties of all following sections
- Adding the offset k to the "SizeOfImage" property of the pe header
- Adding k to all data directory adresses greater or equal 0x5000
What's the problem:
I can start the pe file without the windows loader complaining. Still the new exe crashes because of a call to "_security_init_cookie". If however i use a debugger to patch out the stack cookie calls and jump directly to the real main the programm start's normally.
My question:
How can i fix this error concerning the stack cookies? Where are the adresses in the pe file i need to patch to do so?
I'm aware i'd normally need to patch the reloc table too. In this case i have checked that there are no entries for the sections i want to relocate.
windows assembly memory
edited Nov 12 at 8:58
xmojmr
7,04842240
asked Nov 11 at 15:13
Stephen Ahmad
85
add a comment |
up vote
0
down vote
favorite
i'm trying to increase the size of a pe section which is located after the .text section. I want to increase the size of .rdata by 0x1000 to go from this layout
to that layout
by adding 0x1000 as an offset k to the section size.
What am i doing to achieve this:
- Adding extra size/offset (k) to the "VirtualSize" property of the pe file
- Adding the offset k to all "VirtualAddress" properties of all following sections
- Adding the offset k to the "SizeOfImage" property of the pe header
- Adding k to all data directory adresses greater or equal 0x5000
What's the problem:
I can start the pe file without the windows loader complaining. Still the new exe crashes because of a call to "_security_init_cookie". If however i use a debugger to patch out the stack cookie calls and jump directly to the real main the programm start's normally.
My question:
How can i fix this error concerning the stack cookies? Where are the adresses in the pe file i need to patch to do so?
I'm aware i'd normally need to patch the reloc table too. In this case i have checked that there are no entries for the sections i want to relocate.
windows assembly memory
edited Nov 12 at 8:58
xmojmr
7,04842240
asked Nov 11 at 15:13
Stephen Ahmad
85
Maybe you also need to patch the relocations? To be sure: you don't also want to increase the size of.rodatain the file, do you?
– Margaret Bloom
Nov 11 at 15:46
3
The PECOFF format doesn't support moving sections relative to other sections like this. You can append a section at the end, but you can't insert or expand a section in the middle. If the executable isn't relocatable then all addresses are fixed and all sections need to be loaded at their specified addresses. If the executable is relocatable then entire executable image needs relocated as a single block, so that the distance between any two locations never changes.
– Ross Ridge
Nov 11 at 17:33
@RossRidge I'm aware of this fact. I just thought that since it's after the code section and there are no relocations for the following sections it should work.
– Stephen Ahmad
Nov 16 at 15:01
Could i iterate through the code section fixing all references? I mean effectively i don't need to fix jumps since it's after the code section. I'd need analyze the code section for mov other reference commands check their adresses and fix them.
– Stephen Ahmad
Nov 16 at 15:02
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
i'm trying to increase the size of a pe section which is located after the .text section. I want to increase the size of .rdata by 0x1000 to go from this layout
to that layout
by adding 0x1000 as an offset k to the section size.
What am i doing to achieve this:
- Adding extra size/offset (k) to the "VirtualSize" property of the pe file
- Adding the offset k to all "VirtualAddress" properties of all following sections
- Adding the offset k to the "SizeOfImage" property of the pe header
- Adding k to all data directory adresses greater or equal 0x5000
What's the problem:
I can start the pe file without the windows loader complaining. Still the new exe crashes because of a call to "_security_init_cookie". If however i use a debugger to patch out the stack cookie calls and jump directly to the real main the programm start's normally.
My question:
How can i fix this error concerning the stack cookies? Where are the adresses in the pe file i need to patch to do so?
I'm aware i'd normally need to patch the reloc table too. In this case i have checked that there are no entries for the sections i want to relocate.
windows assembly memory
edited Nov 12 at 8:58
xmojmr
7,04842240
asked Nov 11 at 15:13
Stephen Ahmad
85
i'm trying to increase the size of a pe section which is located after the .text section. I want to increase the size of .rdata by 0x1000 to go from this layout
to that layout
by adding 0x1000 as an offset k to the section size.
What am i doing to achieve this:
- Adding extra size/offset (k) to the "VirtualSize" property of the pe file
- Adding the offset k to all "VirtualAddress" properties of all following sections
- Adding the offset k to the "SizeOfImage" property of the pe header
- Adding k to all data directory adresses greater or equal 0x5000
What's the problem:
I can start the pe file without the windows loader complaining. Still the new exe crashes because of a call to "_security_init_cookie". If however i use a debugger to patch out the stack cookie calls and jump directly to the real main the programm start's normally.
My question:
How can i fix this error concerning the stack cookies? Where are the adresses in the pe file i need to patch to do so?
I'm aware i'd normally need to patch the reloc table too. In this case i have checked that there are no entries for the sections i want to relocate.
windows assembly memory
windows assembly memory
edited Nov 12 at 8:58
xmojmr
7,04842240
asked Nov 11 at 15:13
Stephen Ahmad
85
edited Nov 12 at 8:58
xmojmr
7,04842240
asked Nov 11 at 15:13
Stephen Ahmad
85
edited Nov 12 at 8:58
xmojmr
7,04842240
edited Nov 12 at 8:58
xmojmr
7,04842240
edited Nov 12 at 8:58
xmojmr
7,04842240
7,04842240
asked Nov 11 at 15:13
Stephen Ahmad
85
asked Nov 11 at 15:13
Stephen Ahmad
85
asked Nov 11 at 15:13
Stephen Ahmad
85
85
Maybe you also need to patch the relocations? To be sure: you don't also want to increase the size of.rodatain the file, do you?
– Margaret Bloom
Nov 11 at 15:46
3
The PECOFF format doesn't support moving sections relative to other sections like this. You can append a section at the end, but you can't insert or expand a section in the middle. If the executable isn't relocatable then all addresses are fixed and all sections need to be loaded at their specified addresses. If the executable is relocatable then entire executable image needs relocated as a single block, so that the distance between any two locations never changes.
– Ross Ridge
Nov 11 at 17:33
@RossRidge I'm aware of this fact. I just thought that since it's after the code section and there are no relocations for the following sections it should work.
– Stephen Ahmad
Nov 16 at 15:01
Could i iterate through the code section fixing all references? I mean effectively i don't need to fix jumps since it's after the code section. I'd need analyze the code section for mov other reference commands check their adresses and fix them.
– Stephen Ahmad
Nov 16 at 15:02
add a comment |
Maybe you also need to patch the relocations? To be sure: you don't also want to increase the size of.rodatain the file, do you?
– Margaret Bloom
Nov 11 at 15:46
3
The PECOFF format doesn't support moving sections relative to other sections like this. You can append a section at the end, but you can't insert or expand a section in the middle. If the executable isn't relocatable then all addresses are fixed and all sections need to be loaded at their specified addresses. If the executable is relocatable then entire executable image needs relocated as a single block, so that the distance between any two locations never changes.
– Ross Ridge
Nov 11 at 17:33
@RossRidge I'm aware of this fact. I just thought that since it's after the code section and there are no relocations for the following sections it should work.
– Stephen Ahmad
Nov 16 at 15:01
Could i iterate through the code section fixing all references? I mean effectively i don't need to fix jumps since it's after the code section. I'd need analyze the code section for mov other reference commands check their adresses and fix them.
– Stephen Ahmad
Nov 16 at 15:02
Maybe you also need to patch the relocations? To be sure: you don't also want to increase the size of
.rodata in the file, do you?– Margaret Bloom
Nov 11 at 15:46
Maybe you also need to patch the relocations? To be sure: you don't also want to increase the size of
.rodata in the file, do you?– Margaret Bloom
Nov 11 at 15:46
3
3
The PECOFF format doesn't support moving sections relative to other sections like this. You can append a section at the end, but you can't insert or expand a section in the middle. If the executable isn't relocatable then all addresses are fixed and all sections need to be loaded at their specified addresses. If the executable is relocatable then entire executable image needs relocated as a single block, so that the distance between any two locations never changes.
– Ross Ridge
Nov 11 at 17:33
The PECOFF format doesn't support moving sections relative to other sections like this. You can append a section at the end, but you can't insert or expand a section in the middle. If the executable isn't relocatable then all addresses are fixed and all sections need to be loaded at their specified addresses. If the executable is relocatable then entire executable image needs relocated as a single block, so that the distance between any two locations never changes.
– Ross Ridge
Nov 11 at 17:33
@RossRidge I'm aware of this fact. I just thought that since it's after the code section and there are no relocations for the following sections it should work.
– Stephen Ahmad
Nov 16 at 15:01
@RossRidge I'm aware of this fact. I just thought that since it's after the code section and there are no relocations for the following sections it should work.
– Stephen Ahmad
Nov 16 at 15:01
Could i iterate through the code section fixing all references? I mean effectively i don't need to fix jumps since it's after the code section. I'd need analyze the code section for mov other reference commands check their adresses and fix them.
– Stephen Ahmad
Nov 16 at 15:02
Could i iterate through the code section fixing all references? I mean effectively i don't need to fix jumps since it's after the code section. I'd need analyze the code section for mov other reference commands check their adresses and fix them.
– Stephen Ahmad
Nov 16 at 15:02
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53250099%2fpe-file-section-relocation-and-stack-cookies-error%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Maybe you also need to patch the relocations? To be sure: you don't also want to increase the size of
.rodatain the file, do you?– Margaret Bloom
Nov 11 at 15:46
3
The PECOFF format doesn't support moving sections relative to other sections like this. You can append a section at the end, but you can't insert or expand a section in the middle. If the executable isn't relocatable then all addresses are fixed and all sections need to be loaded at their specified addresses. If the executable is relocatable then entire executable image needs relocated as a single block, so that the distance between any two locations never changes.
– Ross Ridge
Nov 11 at 17:33
@RossRidge I'm aware of this fact. I just thought that since it's after the code section and there are no relocations for the following sections it should work.
– Stephen Ahmad
Nov 16 at 15:01
Could i iterate through the code section fixing all references? I mean effectively i don't need to fix jumps since it's after the code section. I'd need analyze the code section for mov other reference commands check their adresses and fix them.
– Stephen Ahmad
Nov 16 at 15:02