Adding new section?

[Nam Nguyen]

Hello

Is there anyway to add a new section to a PE file?

Looking at the write() method, it doesn't seem to rebuild the whole
file from memory, yea?

Thanks
Nam

[Ero Carrera]

No, pefile does not rebuild the file. It is possible tho. to add a new
section if there's room for the section header, but it involves a bit
of black magic.

--
ero

[Nam Nguyen]

I wrote a small piece to do just this.

It worked in my limited testing.

Cheers
Nam

Index: pefile.py
===================================================================
--- pefile.py (revision 68)
+++ pefile.py (working copy)
@@ -1587,7 +1587,7 @@
# There could be a problem if there are no raw data sections
# greater than 0
# fc91013eb72529da005110a3403541b6 example
- # Should this throw an exception in the minimum header offset
+ # Should this throw an exception if the minimum header offset
# can't be found?
#
rawDataPointers = [
@@ -1662,7 +1662,70 @@

self.parse_data_directories()

+ def add_new_section(self, name, data, characteristics = 0):
+ # FIXME: These 3 lines are copied from above
+ nt_headers_offset = self.DOS_HEADER.e_lfanew
+ optional_header_offset = \
+ nt_headers_offset + 4 + self.FILE_HEADER.sizeof()
+ sections_offset = optional_header_offset + \
+ self.FILE_HEADER.SizeOfOptionalHeader

+ sections_offset += 0x28 * self.FILE_HEADER.NumberOfSections
+
+ # Find extra space for a new section header,
+ # grow header space if necessary
+ header_extra_len = len(self.header)
+ while sections_offset + 0x28 > header_extra_len:
+ header_extra_len += self.OPTIONAL_HEADER.FileAlignment
+ header_extra_len -= len(self.header)
+ header = list(self.header) + ['\x00'] * header_extra_len
+
+ # Pad raw data to align the last section
+ raw = self.__data__[len(self.header) : ]
+ raw_extra_len = (self.OPTIONAL_HEADER.FileAlignment - \
+ (len(raw) %
self.OPTIONAL_HEADER.FileAlignment)) % \
+ self.OPTIONAL_HEADER.FileAlignment
+ raw += "\xDD" * raw_extra_len
+
+ # Pad the data to align this new section
+ data_extra_len = (self.OPTIONAL_HEADER.FileAlignment - \
+ (len(data) %
self.OPTIONAL_HEADER.FileAlignment))
+ raw += data
+ raw += "\xCC" * data_extra_len
+
+ section = SectionStructure
(self.__IMAGE_SECTION_HEADER_format__)
+ section.__unpack__("\x00" * 0x28)
+ section.set_file_offset(sections_offset)
+ section.Name = name[:8] + "\x00" * (8 - len(name))
+ section.Misc = len(data)
+ section.SizeOfRawData = len(data) + \
+ (self.OPTIONAL_HEADER.FileAlignment - \
+ (len(data) % self.OPTIONAL_HEADER.FileAlignment))
+ section.PointerToRawData = len(self.__data__)
+ section.VirtualAddress = self.OPTIONAL_HEADER.SizeOfImage
+ section.Characteristics = characteristics
+
+ self.FILE_HEADER.NumberOfSections += 1
+ self.__structures__.append(section)
+ self.sections.append(section)
+
+ self.OPTIONAL_HEADER.SizeOfHeaders += header_extra_len
+ self.OPTIONAL_HEADER.SizeOfImage += section.SizeOfRawData + \
+ (self.OPTIONAL_HEADER.SectionAlignment - \
+ (section.SizeOfRawData %
self.OPTIONAL_HEADER.SectionAlignment))
+
+ for s in self.__structures__:
+ if isinstance(s, SectionStructure):
+ s.PointerToRawData += header_extra_len
+ if s.__file_offset__ > sections_offset:
+ s.__file_offset__ += header_extra_len
+
+ header[sections_offset : sections_offset + 0x28] =
section.__pack__()
+ self.header = ''.join(header)
+ self.__data__ = self.header + raw
+
+ return section
+
def write(self, filename=None):
"""Write the PE file.

> > Nam- Hide quoted text -
>
> - Show quoted text -