Code beyond the JMP TABLE

[Ksbunker]

[detten]

Do you mean while linking, or when you fiddle with the PE header manually?

[Ksbunker]

Was in a hurry when I posted that!

More information.

I can mess around with the PE post-linking, but I'd very much prefer to learn (if indeed one can) before/during linking.

I'm trying to make a crackme whereby, its general layout is as follows;

.data

;data

.code

EntryPoint:

;code

;jmp table

; db 1024 dup(0)
; code called in TLSCallback
end EntryPoint

[detten]

Do you really need to have the code behind the jmp table in the same section?
If so, this is something I never tried. Still a couple of possible pointers :

All entries in the import redirect table are created like you would use EXTERN variables in your code. the linker automatically creates an entry in the table that 'links' to some lib you added to the linker. So I guess that is the way to go if you want to have extra code there. Maybe one redirection jump from there to your code is enough?

On the other hand, if you settle with modifying your app at runtime, there are possibilities to hack up the import table. You could for example have your codepiece encoded in whatever section, and have some code executed at startup that decodes it and injects it after the import redirect table...
Some good starter reading for that : http://www.codeproject.com/KB/system/inject2it.aspx

If you do find a clean way to do this without messing after linking, I'm interested to know how to do it

[stingduk]

you mean like this ksbunker

[detten]

Nice explanation stingduk, I forgot all about your precious tool!