hi all,
I was trying to encode a metasploit generated payload (EXE file )using shikata_ga_nai encoder . The encoder failed and reported that the .text section of the PE file was too small to be usable. So it implied that I needed to add some extra bytes to the .text section.
I followed a tutorial from the internet, wherein the last section of a PE - the .rsrc section, was extended by 1000 bytes. I tried to do the same thing to the .text section , but the .exe stops running
I understand that I have to relocate all the following sections as my .text section is the first section in the PE. I used lordPE and Hex workshop to do that, but obviously did not succeed.
Can someone guide me as to how to extend the .text section and also relocate the following sections, such that the PE still remains functional ?
thanks in advance and hoping to learn from you all
bye
jintao

You need to modify in PE header at least all of this:
- For every section its Virtual and Raw address. In the first section, also the Virtual and Raw Size.
- In the optional header:
-- SizeOfCode parameter, it should be at least the new size of your code.
-- BaseOfData parameter, it should match the new start address for it
-- SizeOfImage parameter, it could be performed as Virtual address of last section plus virtual size (normalized to SectionAlignment)
- In Data Directories:
-- Have a look at all addresses shown. Normally they make reference to relative virtual addresses where a certain section starts. You'll have to modify all of them to match the new virtual addresses in your sections.
Pay attention specially to "Import Directory RVA" and "Import Address Table Directory RVA" parameters. The content of this pointers must be the same than in the original file, so update these addresses carefully.


In the file, you have to cut it at the raw address of the second section.
Then append the new space of bytes that will contain your code. Its size must be multiple of FileAlignment parameter in Optional header of PE header.
Then, append the rest of the file as it was...

As I mentioned before, and if I don't forget something, this is at least the minimum that must be done to get a valid PE file.

Please report any problem when doing this stuff.

Best regards

Nacho_dj