Search code examples
reverse-engineeringexeassemblyportable-executabledisassembly

Making space for added bytecode (machine code) in a Windows PE executable


This question is related to reverse engineering / binary patching on Windows.

I need a free tool exist to allow me to add assembler (or machine code) to an already built executable. I am not talking about Java or .NET but native bytecode (x86 machine code).

Also, What if I need more space? Do I have to add another section? what tool exists for expanding a PE exe?


Solution

  • There are couple of ways of adding your code to the existing pe file. One way is to find a cave in the code section, cave is generally a section that is filled with zero. another(better) way is to add a Section to the PE file so that you'll have space for your code. This is a bit challenging as you have to manually adjust various pointer like, SizeOfImage,RawSize etc etc.

    You can use LORDPE(google it) for this.