i've this simple code test code:
#include <Windows.h>
#include <stdio.h>
/* Declare new sections to store encrypted code and shellcode data */
#pragma section(".code", execute, read, write)
#pragma comment(linker,"/SECTION:.code,ERW")
// From here executable code will go in .code section
#pragma code_seg(".code")
int test()
{
printf("prova");
return 0;
}
// .stub SECTION
#pragma section(".stub", execute, read, write)
#pragma code_seg(".stub")
int main(int argc, char *argv[]){
test(); /* Call function which executes shellcode now that it is decrypted */
return 0;
}
Can anyone tell me why if i dump this file i only got this default section:
- .data
- .rdata
- .reloc
- .rsrc
- .stub
- .text
The .code segment it's not generated. I think I used to do like this in some previuos project, am i doing something wrong?
-- Further tests --
- Dumping the
.objfile the.codesection is shown. .stubgets showed dumping.exeor.obj- removing
#pragma comment(linker,"/SECTION:.code,ERW")did not work - adding
#pragma comment(linker,"/SECTION:.stub,ERW")didn't change dumpbin result on.exe,.stubstill showing - change the name from
.codeto.somethingelsedidn't work either, same result
Using the following directives i was able to confine all the code/variable/costant into the
.codesegment which was visible using the dumbin command.