andyvand / pefile

Automatically exported from code.google.com/p/pefile
Other
0 stars 0 forks source link

Wriing section data back #18

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
I am trying to change the data in sections but does not seem to be working.
If I do:
pe.sections[3].data = "any thing"

#this willl print "any thing"
#print pe.sections[3].data

but when I do the write:
pe.write(filename=newfile.exe)

It does not seem to write the change and both the old file and the new one have 
the same content. Is there any idea of why this is happening?

Thanks

Original issue reported on code.google.com by moealsa...@gmail.com on 20 Jun 2010 at 3:03

GoogleCodeExporter commented 9 years ago
That's not the correct way of modifying data. The methods "set_bytes_at_rvaæ, 
"set_bytes_at_offset" exist to accomplish that. They will update the data 
(propagating all changes) in all places where it's relevant, including the 
section objects.

set_bytes_at_rva(rva, data)
"Overwrite, with the given string, the bytes at the file offset corresponding 
to the given RVA.
Return True if successful, False otherwise. It can fail if the
offset is outside the file's boundaries."

set_bytes_at_offset(offset, data):
"Overwrite the bytes at the given file offset with the given string.
Return True if successful, False otherwise. It can fail if the
offset is outside the file's boundaries."

Additionally the following exist to write values into the PE image:

set_dword_at_rva(rva, dword) 
"Set the double word value at the file offset corresponding to the given RVA."

set_dword_at_offset(offset, dword) 
"Set the double word value at the given file offset."

set_word_at_rva(rva, word) 
"Set the word value at the file offset corresponding to the given RVA."

set_word_at_offset(offset, word):
"Set the word value at the given file offset."

set_qword_at_rva(rva, qword):
"Set the quad-word value at the file offset corresponding to the given RVA."

set_qword_at_offset(offset, qword):
"Set the quad-word value at the given file offset."

Original comment by ero.carr...@gmail.com on 16 Aug 2010 at 11:33