How to modify exe file's entry point? - exe

Question

I'm trying to add a jmp instruction at the end of text section in the calc.exe for windows XP, and I've added it and modified the entry point to start from that address and modified the virtual size of the text section so that it can handle the added instruction, but the result exe didn't work. so am I missing any thing here?
here is the C# code I've wrote to handle those things:
public static void inject()
{
StreamReader sr = new StreamReader("C:\\calc.EXE");
BinaryReader br = new BinaryReader(sr.BaseStream);
List<byte> bytesList = new List<byte>();
for (long i = 0; i < br.BaseStream.Length; i++)
{
bytesList.Add(br.ReadByte());
}
{
// updating the entry point
bytesList[280] = 176;
bytesList[281] = 42;
bytesList[282] = 1;
bytesList[283] = 0;
}
{
bytesList[496] = 192;
}
{
// second jmp
bytesList.RemoveRange(76464, 5);
byte[] injectedBytes = { 233, 255, 255, 249, 192 };
bytesList.InsertRange(76464, injectedBytes);
}
StreamWriter sw = new StreamWriter("C:\\calc2.EXE");
BinaryWriter bw = new BinaryWriter(sw.BaseStream);
bw.Write(bytesList.ToArray());
bw.Close();
}
and thanks in advance

Answer 1

When you change (in your case Add/Enlarge) a Section (in your case the Code Section, aka the so-called text Section), you MUST also tell the Windows Loader to map this additional part into Memory by modifying the Section's associated Header (descriptor). In your case, it looks like you did not make this and the Loader won't load the new code (and in your case, it won't even load/start the application). Modifying Image Files is cool, but takes time to master.
Portable Executable File Format – A Reverse Engineer View shows how it works.