So in this video we'll be mapping the sections from the rod disk that is this byte area to the memory.
So we have already this group looping over these sections and passing these sections as, as each of
the.
So as each of the first section as the top one is the second section, etc..
So we can pass the section or data and throw it into memory here only.
But you can also use another for loop as well.
So I'm using another for loop.
Let's say region.
Mapping sections into memory.
And so we can after writing the code, you can just click this minus icon to collapse this code, so
you can just
collapse this entire section to save some space.
So now we are going to map the sections for INT is equal to zero i less than the number of sections
and the header.
That file had a number of sections.
I press.
Press.
And we we don't need to again pass these sections.
We have already sections stored in this area, etc..
So what we need to do is if you go to this P e where you can see the RA address on the disk.
So I have this internet problem.
So it's going to load very slowly.
So if you go to a hex editor, you can see from the 400 the offset, you have the content of the text
section and the size is 1200, but virtual size is 1000.
These are 200 extra bytes are due to another byte padding because of the file arrangement.
That's why the zero bites have been appended at the last.
But the actual size is what, sir?
What size is one zero 40.
So this is a virtual address.
So sorry for that.
So in memory, the content which is starting at this 400,000 should start at the thousandth offset.
So let's go and declare it by to store the contents.
There is a section that is equal to new battery off and how much size we want to allocate that is defined
as each of a dot virtual size.
Now we need to read the data from this.
That is filed by the.
From the offset this section dot section header section header dot pointer to RAS data.
So far, Jay-Z calls to zero jail less than.
Copy.
This virtual side is here, so we need to read these many number of bytes.
The press.
Press.
On these many number of words, starting from Rafael off a switch of five dot pointer to raw data.
So this pointer to data pointing to this section's starting data, the offset of the starting data.
Let me see the file.
Let me open this file in the hex editor.
You can see there are addresses 400.
If you go to this 400, you will see the content of this.
Text section.
So the raw data point to the data is pointing to the that the 400 to offset we need to add for this
is the loop we want to read.
So we'll be reading this.
These many number of bytes up to this virtual size.
And we gonna assign this to section data of the.
So we have this section data.
Now, what we can do is we can go and map this for a semicolon here.
So we can copy this whole data into this virtual space.
So sorry.
Virtual address.
So you can say Marshall Art copy and the source not the source is section data and starting index is
zero and the destination is based address.
And remember, the virtual address is the offset from the image base.
So image base is something from that offset of the thousand bytes.
We have this this sections data so we can just say section data dot within.
So that's it.
We have successfully copied.
And one thing you need to change is this.
Pedro says to image this.
Because the headdress is only fit for only the headers, because we are relocating the sections, we
need to allocate the whole size.
So what we're going to do is I'm going to put a break point at this march or that copy.
So let's go and run this.
And the starting address is this one.
And you can see the exact now you can click on these columns and click on 16.
So you get exact 16 columns of bytes as that of this hex editor.
So it would be very easy to compare for you.
And here we can see this is a completely in.
And if I go and step into this.
And I should see some data.
Okay.
This is me.
Copy this address.
And press zero 6000.
Okay.
I think we did not copy correctly.
Oh, sorry.
At the base address, plus a sci of fi.
Dot.
What's your address?
Sorry for this.
What's your address?
Now let's put a breakpoint here.
And we have the B file contents and if you add zero X thousand.
What you see are the debates because we did not execute this copy
instruction.
So let's step into this.
And here we can see the exact.
Data, which we can see in the hex editor and you can continue on this and you hit another breakpoint
because this is the for loop.
We are looping over this and we're hitting breakpoint again.
So and the next address is 3000.
If you go and.
Safe Bets Address Price zero x 3000.
And now let's go and step into this and we will see the.
Another section.
So here we have the raw data.
So our data also contains inputs.
Here we can also see in the text, ASCII text, you can see exit process or Canada data.
So these are the inputs.
We'll be fixing these inputs in the next video.
So everything up to now is fine.
So let's click on Continue.
Now we have passed the P headers and we have copied those headers into the memory and also we have mapped
these sections into memory.
So up to now, let's test whether everything is correct or not.
So I have this.
There are no dependencies to THC which will pop up in CMD and it does not have any imports based relocations,
etc. So if we have done correctly, we should execute this no dependency on THC.
So let's go and create a remote thread at the entry point.
So we have this entry point here.
And at this this is the starting of the stages.
So what we are going to do is we are going to create a remote threat.
Sorry.
Not remotely.
Create thread.
The stag says zero.
And the third one is the starting address, starting addresses, based address, press and T header
dot optional header dot at the soft entry point.
And the parameters to these functions are null.
Creation flex zero and the reference to the thread.
So let's say our thread handle is equal to.
And output ease.
We will get the thread handle from this function's return.
Return and we will also get this thread data.
Now we can go and print.
The Third Lady.
So let's do this and let's.
Copy as part.
And change the part to this one.
So we are basically.
Pasting the contents into memory and executing at this entry point.
So let's put a break point at this for sort of three.
It's also put time before this creating a threat and start this.
And you have this base address.
And we can see our program has been successfully copied.
So if everything goes well, we should see a new cmd pop up.
So we are successfully executing the.
Binary inside our process memory.
So you can print the this is the thread data.
So if you continue this.
And we can close this one.
So we have successfully mapped the sections into memory.
So what we have done is we have read the sections content from this rather point out the raw data,
and then we have copied the virtual size amount of bytes into the memory.
And since our entire memory was required to execute, our code got executed.
So you can change it here.
While allocating, you can read the sections characteristics and determine whether they are readable,
readable, executable and use whatever product to change their protections.
So you can do that as well.
For just simplicity and to data purposes, I have assigned this 3.0.