Alo

I want to add funtionality to notepad (winxp). I have found where I want to jmp from and now I need a place to add my code. I use LordPe deluxe.

1. use .Code section -> not enough space

2. resize last section (.rsrc)
- set Vsize and Rsize to a bigger size.
- set flags to E0000060
- Sizeofimage changes automatic.

Now the program don't start -> Notepad.exe is not a valid win32 application.

3. Add new section -> same problem

What am I doing wrong. I have used the "search function" but can't find anything.

Please guide me....Thx

Chitech

Hello chitech !

I can't verify this on my own, since the WinXP Notepad fails to load some imports on Win98, but if you add a new section, you overwrite the start of the "Bound Imports" table in the header.

So one possibility would be resizing the .code section and correcting all affected pointers, or moving the "Bound Imports" table some bytes forward in the header and correcting the "Bound Imports" directory entry, so you've space for a new section.

I don't know why you can't resize the .rsrc section. I tried it and it worked. The program still showed my that it can't find some imports, but I think checking if a file is a valid Win32-PE file comes before trying to load imports.

alo DakienDX

I forgot to "truncate at end of section" Me very bad

Thx DakienDX.....(everytime I post a tread u r the first person who answer my questions)


See u guys around

Chitech