Visual C++ produces binaries with .code, .rdata, and .data sections (in that order). Themida merges all three into a nameless section, which is detrimental to analysis. In particular, I want to run the Extra Pass plugin for IDA on a dump from memory of a Themida'd executable (imports not recovered), but it needs the real bounds of the .code section or it will aggressively convert a lot of actual data into code.How could I go about recovering the base of the .rdata and .data sections?
Recovering original PE sections after Themida merges them
windows;pe
Basically the best way to start doing this is to compile your own EXE (with the same compiler as the Themida protected file when possible) and try to merge the sections by yourself. I crafted an example for you (source code: http://codepad.org/RqNiH3Ly, download RAR (merged + directly compiled): https://mega.co.nz/#!aoAUALBJ!6riSM4VmT43Ywf_jxQAY73EsVXyjEAAhJ1rOSGaYdeI, just some executable I was working with at the moment, compiled with VS10).The base of the .data section can basically be found by searching for references to every address aligned to 0x1000 in the code (VS10 uses data pointers in order, so just scroll up to the base of the first section and look for a pointer). For example:01251000  /$  81EC 0C010000 SUB ESP,10C  01251006  |.  A1 00302501   MOV EAX,DWORD PTR DS:[1253000] ; pointer to .data  0125100B  |.  33C4          XOR EAX,ESPIn my case (the EXE also has relocations) the ImageBase was 0x1250000, so the RVA of the .data section would be 0x1253000 - 0x1250000 = 0x3000The .rdata section is just the RVA aligned up to 0x1000 from the actual end of the code (you can learn this from the original file). In this case:012518E2   $- FF25 60202501 JMP DWORD PTR DS:[<&MSVCR100._except_han>  012518E8   $- FF25 64202501 JMP DWORD PTR DS:[<&MSVCR100._invoke_wat>  012518EE   $- FF25 68202501 JMP DWORD PTR DS:[<&MSVCR100.controlfp> ; end  012518F4      00            DB 00  012518F5      00            DB 000x12518EE - 0x1250000 = 0x18EE, rounded up 0x2000, so the original RVA of the .rdata section is 0x2000.Similar calculations can be done for the .reloc section (search for the binary mask 3? 3? 3? 3? 3? will get you pretty close on x86).Just learn to know the compiler structure and use it to recover something similar to the original (maybe Themida just appends the raw section data and changes all data pointers etc). Hope this helps a little :)