blob: 5599fd85f25ce7132c5f15c9adeb943cd62acbaf (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
Information on every section after two sections have been added:
[IMAGE_SECTION_HEADER]
0x1F8 0x0 Name: .text
0x200 0x8 Misc: 0x53371
0x200 0x8 Misc_PhysicalAddress: 0x53371
0x200 0x8 Misc_VirtualSize: 0x53371
0x204 0xC VirtualAddress: 0x1000
0x208 0x10 SizeOfRawData: 0x54000
0x20C 0x14 PointerToRawData: 0x1000
0x210 0x18 PointerToRelocations: 0x0
0x214 0x1C PointerToLinenumbers: 0x0
0x218 0x20 NumberOfRelocations: 0x0
0x21A 0x22 NumberOfLinenumbers: 0x0
0x21C 0x24 Characteristics: 0x60000020
[IMAGE_SECTION_HEADER]
0x220 0x0 Name: .rdata
0x228 0x8 Misc: 0x1B23E
0x228 0x8 Misc_PhysicalAddress: 0x1B23E
0x228 0x8 Misc_VirtualSize: 0x1B23E
0x22C 0xC VirtualAddress: 0x55000
0x230 0x10 SizeOfRawData: 0x1C000
0x234 0x14 PointerToRawData: 0x55000
0x238 0x18 PointerToRelocations: 0x0
0x23C 0x1C PointerToLinenumbers: 0x0
0x240 0x20 NumberOfRelocations: 0x0
0x242 0x22 NumberOfLinenumbers: 0x0
0x244 0x24 Characteristics: 0x40000040
[IMAGE_SECTION_HEADER]
0x248 0x0 Name: .data
0x250 0x8 Misc: 0x7E04
0x250 0x8 Misc_PhysicalAddress: 0x7E04
0x250 0x8 Misc_VirtualSize: 0x7E04
0x254 0xC VirtualAddress: 0x71000
0x258 0x10 SizeOfRawData: 0x1000
0x25C 0x14 PointerToRawData: 0x71000
0x260 0x18 PointerToRelocations: 0x0
0x264 0x1C PointerToLinenumbers: 0x0
0x268 0x20 NumberOfRelocations: 0x0
0x26A 0x22 NumberOfLinenumbers: 0x0
0x26C 0x24 Characteristics: 0xC0000040
[IMAGE_SECTION_HEADER]
0x270 0x0 Name: .rsrc
0x278 0x8 Misc: 0x3B90
0x278 0x8 Misc_PhysicalAddress: 0x3B90
0x278 0x8 Misc_VirtualSize: 0x3B90
0x27C 0xC VirtualAddress: 0x79000
0x280 0x10 SizeOfRawData: 0x4000
0x284 0x14 PointerToRawData: 0x72000
0x288 0x18 PointerToRelocations: 0x0
0x28C 0x1C PointerToLinenumbers: 0x0
0x290 0x20 NumberOfRelocations: 0x0
0x292 0x22 NumberOfLinenumbers: 0x0
0x294 0x24 Characteristics: 0x40000040
[IMAGE_SECTION_HEADER]
0x298 0x0 Name: .NewSec
0x2A0 0x8 Misc: 0x6
0x2A0 0x8 Misc_PhysicalAddress: 0x6
0x2A0 0x8 Misc_VirtualSize: 0x6
0x2A4 0xC VirtualAddress: 0x7D000
0x2A8 0x10 SizeOfRawData: 0x1000
0x2AC 0x14 PointerToRawData: 0x76000
0x2B0 0x18 PointerToRelocations: 0x0
0x2B4 0x1C PointerToLinenumbers: 0x0
0x2B8 0x20 NumberOfRelocations: 0x0
0x2BA 0x22 NumberOfLinenumbers: 0x0
0x2BC 0x24 Characteristics: 0x60000020
[IMAGE_SECTION_HEADER]
0x2C0 0x0 Name: .NewSec
0x2C8 0x8 Misc: 0x6
0x2C8 0x8 Misc_PhysicalAddress: 0x6
0x2C8 0x8 Misc_VirtualSize: 0x6
0x2CC 0xC VirtualAddress: 0x7E000
0x2D0 0x10 SizeOfRawData: 0x1000
0x2D4 0x14 PointerToRawData: 0x77000
0x2D8 0x18 PointerToRelocations: 0x0
0x2DC 0x1C PointerToLinenumbers: 0x0
0x2E0 0x20 NumberOfRelocations: 0x0
0x2E2 0x22 NumberOfLinenumbers: 0x0
0x2E4 0x24 Characteristics: 0x60000020
The instructions at the beginning of the last section:
jmp 0x44d4df
nop
Information on every section after one of the added sections has been removed:
[IMAGE_SECTION_HEADER]
0x1F8 0x0 Name: .text
0x200 0x8 Misc: 0x53371
0x200 0x8 Misc_PhysicalAddress: 0x53371
0x200 0x8 Misc_VirtualSize: 0x53371
0x204 0xC VirtualAddress: 0x1000
0x208 0x10 SizeOfRawData: 0x54000
0x20C 0x14 PointerToRawData: 0x1000
0x210 0x18 PointerToRelocations: 0x0
0x214 0x1C PointerToLinenumbers: 0x0
0x218 0x20 NumberOfRelocations: 0x0
0x21A 0x22 NumberOfLinenumbers: 0x0
0x21C 0x24 Characteristics: 0x60000020
[IMAGE_SECTION_HEADER]
0x220 0x0 Name: .rdata
0x228 0x8 Misc: 0x1B23E
0x228 0x8 Misc_PhysicalAddress: 0x1B23E
0x228 0x8 Misc_VirtualSize: 0x1B23E
0x22C 0xC VirtualAddress: 0x55000
0x230 0x10 SizeOfRawData: 0x1C000
0x234 0x14 PointerToRawData: 0x55000
0x238 0x18 PointerToRelocations: 0x0
0x23C 0x1C PointerToLinenumbers: 0x0
0x240 0x20 NumberOfRelocations: 0x0
0x242 0x22 NumberOfLinenumbers: 0x0
0x244 0x24 Characteristics: 0x40000040
[IMAGE_SECTION_HEADER]
0x248 0x0 Name: .data
0x250 0x8 Misc: 0x7E04
0x250 0x8 Misc_PhysicalAddress: 0x7E04
0x250 0x8 Misc_VirtualSize: 0x7E04
0x254 0xC VirtualAddress: 0x71000
0x258 0x10 SizeOfRawData: 0x1000
0x25C 0x14 PointerToRawData: 0x71000
0x260 0x18 PointerToRelocations: 0x0
0x264 0x1C PointerToLinenumbers: 0x0
0x268 0x20 NumberOfRelocations: 0x0
0x26A 0x22 NumberOfLinenumbers: 0x0
0x26C 0x24 Characteristics: 0xC0000040
[IMAGE_SECTION_HEADER]
0x270 0x0 Name: .rsrc
0x278 0x8 Misc: 0x3B90
0x278 0x8 Misc_PhysicalAddress: 0x3B90
0x278 0x8 Misc_VirtualSize: 0x3B90
0x27C 0xC VirtualAddress: 0x79000
0x280 0x10 SizeOfRawData: 0x4000
0x284 0x14 PointerToRawData: 0x72000
0x288 0x18 PointerToRelocations: 0x0
0x28C 0x1C PointerToLinenumbers: 0x0
0x290 0x20 NumberOfRelocations: 0x0
0x292 0x22 NumberOfLinenumbers: 0x0
0x294 0x24 Characteristics: 0x40000040
[IMAGE_SECTION_HEADER]
0x298 0x0 Name: .NewSec
0x2A0 0x8 Misc: 0x6
0x2A0 0x8 Misc_PhysicalAddress: 0x6
0x2A0 0x8 Misc_VirtualSize: 0x6
0x2A4 0xC VirtualAddress: 0x7D000
0x2A8 0x10 SizeOfRawData: 0x1000
0x2AC 0x14 PointerToRawData: 0x76000
0x2B0 0x18 PointerToRelocations: 0x0
0x2B4 0x1C PointerToLinenumbers: 0x0
0x2B8 0x20 NumberOfRelocations: 0x0
0x2BA 0x22 NumberOfLinenumbers: 0x0
0x2BC 0x24 Characteristics: 0x60000020
The instructions at the beginning of the last section:
jmp 0x44c4df
nop
|
