I've updated to 2.36.1 to ensure this problem didn't go away but it didn't. I am building GRUB2 (2.04-1ubuntu26.11) for UEFI booting. We now need to add a .sbat section to the PE binaries loaded by shim. However, when I attempt to add it using either: --add-section .sbat=my_csv_file_304_bytes.csv --set-section-flags .sbat=contents,alloc,load,readonly,data grubx64.efi or as the example they give in SBAT.md --set-section-alignment '.sbat=512' --add-section .sbat=my_csv_file_304_bytes.csv grubx64.efi The PE won't load because the VirtualAddress set for the new .sbat section is 0 and it must be as large or larger than the SizeOfHeaders value in the Image Optional Header (mine is 4096). When I add .sbat to a 686 kernel like vmlinuz it creates a VirtualAddress for the .sbat as 0xFF000000 (sorry I didn't have the 64bit kernel available to see what it did for it). So I'm not sure how to fix objcopy to add the section to the PE64 file with the correct virtual address, I presume a bug or maybe I have to do something else? Thanks.
Well there is another problem, you can't add sections on PE/PE64 before the other existing sections without fixing up all offsets which means looking at opcodes and addresses, so much better if it only added to the end of existing sections, not at the start. Likewise it should update the virtual memory address to match. I was looking at the code, not sure if the osections[] array created are the existing sectors and where it will output (only if gaps?). It's not easy to follow the code being new to it. That option to add section to end is needed for the PE/PE64 types.
(In reply to David F. from comment #1) Actually, objcopy could know it added some number of sections (set the virtual address (vma) in them to match the file offset so shim doesn't complain) and where the existing sections new location will be and then use the relocation table to update the code and update the relocation table as well.
See the code near the comment "Special processing for PE", where adding .gnu_debuglink for PE is handled specially. Something like that would probably be the right thing to do for added sections where --change-section-vma doesn't set their VMA non-zero.