Search code examples
cheaderportable-executablesegmentdumpbin

C program new segment declaration


i've this simple code test code:

#include <Windows.h>
#include <stdio.h>

/* Declare new sections to store encrypted code and shellcode data */
#pragma section(".code", execute, read, write)
#pragma comment(linker,"/SECTION:.code,ERW")

// From here executable code will go in .code section
#pragma code_seg(".code")


int test()
{
    printf("prova");
    return 0;
}

// .stub SECTION
#pragma section(".stub", execute, read, write)
#pragma code_seg(".stub")

int main(int argc, char *argv[]){
    test(); /* Call function which executes shellcode now that it is decrypted */
    return 0;
}

Can anyone tell me why if i dump this file i only got this default section:

  • .data
  • .rdata
  • .reloc
  • .rsrc
  • .stub
  • .text

The .code segment it's not generated. I think I used to do like this in some previuos project, am i doing something wrong?

-- Further tests --

  • Dumping the .obj file the .code section is shown.
  • .stub gets showed dumping .exe or .obj
  • removing #pragma comment(linker,"/SECTION:.code,ERW") did not work
  • adding #pragma comment(linker,"/SECTION:.stub,ERW") didn't change dumpbin result on .exe, .stub still showing
  • change the name from .code to .somethingelse didn't work either, same result

Solution

  • Using the following directives i was able to confine all the code/variable/costant into the .code segment which was visible using the dumbin command.

    #pragma section(".code", execute, read)
    #pragma section(".codedata", read, write)
    #pragma comment(linker,"/SECTION:.code,ERW")
    #pragma comment(linker,"/SECTION:.codedata,ERW")
    #pragma comment(linker, "/MERGE:.codedata=.code")
    
    #pragma code_seg(".code")
    #pragma data_seg(".codedata")
    #pragma const_seg(".codedata")