Well if you look at this diagram, PE schematic then it spilts a PE into various section, so if you were to load a PE into a HEX editor, how would you know where the various sections start and stop ?

For example say i wanted to change some data within a PE by changing hex values in a hex editor but didn't want to alter any of the important sections i,e the,

DOS MZ header
DOS stub
PE header or the
Section table

how would i do this ?
Posted on 2004-03-11 16:23:14 by jonnyr
Try "Stud_PE" in programmerstools web site Protools.cjb.net has features like you wishing.
Posted on 2004-03-11 16:34:39 by cakmak
jonnyr

There are a lot of tools to do what you want, you can try:

snippetcreator (in iczelion's page, source code section)
lordpe (in http://mitglied.lycos.de/yoda2k/)

If you want to do it with a hexadecimal editor, you need
to know about the PE header structures. The section
tables have a member (RawOffset) that specifies the offset
where each section begins and other that specifies their
size (RawSize).
Posted on 2004-03-12 20:33:02 by n u M I T_o r