Hello,

I'm trying to add a section to the end of a EXE file. It's a dump of some internally decrypted code and what I'm trying to do it replace the decryption routine with a mem copy routine to just grab the decryped data out of memory and copy it to the correct place. Unfortunately the routine is too big to place somewhere in the regular code section.. or attach to the end of the code section. So I tried to add a section. Used PEditor, added it, changed image size, that seemed to work fine, but Softice doesn't seem to want to "see" it. I just get INVALIDs when trying to view that memory, Sice says "Page not loaded"?? Not sure what to do here? It does label the section as PROGRAM.newsection, but the data area is filled with '??'

Any help is appreciated

Hi,

I think you just have to wait until that new section code is executed, then sice will display it... it happens to me all the time too, when i trace into that area, sice will automatically page in the memory section.. or you can try the pagein command but i am not sure if it works :>

Hope this helps,

Cheers

Just a thought. Did you fix the PEHeader which contains the sections count? I'm sure PEditor would've done this for you already byt just in case, verify this

Signed,
-- FoxThree

I just got thru seeing the same thing on my system, the solution was to use the pagein command. Apparently the OS doesn't bother loading a disk page into memory until it is used. You can force it to load by using pagein with the memory address of your new section.

ALso, rest assured that even if you cannot see it in SoftIce right away, if you have code that is to be executed it will work.

-nt20