.baidu.com/s/1_87QNHaZYlfY_5uwIRePUQ?pwd6gds

提取码6gds

当程序执行完了要把dll从4GB空间被卸载也会调用一次DllMain

很淦各种问题频出这回做了整整六个小时六个小时啊有木有总结就是太自大了没认真听课直接上手吃瘪了。

首先说说创建dll文件吧我选择的是用.def导出这样我就可以用Depend查看里边的具体函数名和导出序号。

很淦的是当学到动态链接库的时候尝试过自己用def导出dll文件当时啥问题都没有一路畅通但是很淦的是昨天却死活导不出只有dll没有lib文件导致把dll放到Depend什么东东都没看见。

各大资料博客哥们都要翻烂了还是没能解决最后.......家人们好无语啊原来我添加def的时候是通过手动改后缀为.def然后死活不行机缘巧合我删了原来的def采用下图这样添加.def文件然后导出涅马成功导出dll和lib了。

耗费一小时

#include

DLL_PROCESS_ATTACH:Init();break;case

DLL_PROCESS_DETACH:Destroy();break;}return

TRUE;

谈谈我的理解当exe想要调用dll里的函数的时候首先去导入表找对应的函数名或者导出序号如果IAT有现成的已经绑定好的地址那么就直接调用如果没有则需要通过INT

IAT表存着的函数名或者导出序号然后调用GetProcAddress()

函数去导出表找对应的函数真实地址填在IAT然后调用函数。

精简的回答

第一步移动导入表

首先我们要明白为什么要移动导入表为什么不能在EXE程序最后一个导入表后面追加一个导入表呢

就拿我这个程序来说黑色部分就是导入表了可以看到导入表的后门就是一大堆我也不知道啥数据但是肯定动了就寄了因此根本没空间让我们新添加东西所以我们只能扩大节或者新增节去挪动我们的导入表这里我选择的是新增节

改PE头关于节的属性改exe程序的大小,记住新增节的属性是0XC0000060反正权限都给就对了然后讲节表里的导入表的偏移地址修改成挪动后的地址

就是构造IAT,INT的时候要注意结束符要留够一个DWORD大小的0不然在PEtool甚至不能分析新增dll的和里面的函数。

淦太淦了还有导入表的OriginalFirstThunk和FirstThunk要先指向一个IMAGE_THUNK_DATA的结构这个结构是一个联合体

typedef

AddressOfData;//指向IMAGE_IMPORT_BY_NAME}

u1;

而不是让导入表的OriginalFirstThunk和FirstThunk直接指向IMAGE_IMPORT_BY_NAME结构。

VOID

PE::Import_Table_Injection(Data

my_data)

sizeof(IMAGE_IMPORT_DESCRIPTOR);DWORD

dll_size

my_data.my_optional-SizeOfImagedll_size;Data

new

char[new_data_size];memset(new_data.Stretch_Data,

new_data_size);DWORD

_msize(new_data.Stretch_Data);memcpy_s(new_data.Stretch_Data,

new_data_size,

my_data.my_optional-SizeOfImage);//修改节的属性Analyze_PE(new_data,

2);new_data.my_file-NumberOfSections

2);//必须再分析一次否则Remove_Relocation_Data.my_section[Remove_Relocation_Data.my_file-NumberOfSections

1]会报错new_data.my_optional-SizeOfImage

new_data_size;new_data.my_section[new_data.my_file-NumberOfSections

1]-Characteristics

my_data.my_section[0]-Characteristics;new_data.my_section[new_data.my_file-NumberOfSections

1]-Misc.VirtualSize

real_dll_size;memcpy_s(new_data.my_section[new_data.my_file-NumberOfSections

1]-Name,

7);new_data.my_section[new_data.my_file-NumberOfSections

my_data.my_section[0]-NumberOfLinenumbers;new_data.my_section[new_data.my_file-NumberOfSections

my_data.my_section[0]-NumberOfRelocations;new_data.my_section[new_data.my_file-NumberOfSections

my_data.my_section[0]-PointerToLinenumbers;new_data.my_section[new_data.my_file-NumberOfSections

1]-PointerToRawData

my_data.my_section[my_data.my_file-NumberOfSections

1]-PointerToRawData

my_data.my_section[my_data.my_file-NumberOfSections

1]-SizeOfRawData;new_data.my_section[new_data.my_file-NumberOfSections

my_data.my_section[0]-PointerToRelocations;new_data.my_section[new_data.my_file-NumberOfSections

1]-SizeOfRawData

size_of_rawdata;new_data.my_section[new_data.my_file-NumberOfSections

1]-VirtualAddress

my_data.my_section[my_data.my_file-NumberOfSections

1]-VirtualAddress

Section_Align(my_data.my_section[my_data.my_file-NumberOfSections

1]-Misc.VirtualSize,

my_data);cou***xRva_To_Foa(0x10eac,

new_data)endl;cout

sizeof(IMAGE_IMPORT_DESCRIPTOR);DWORD*

import_table_ptr

(DWORD*)my_data.my_Import_Directory[0];DWORD*

new_data_ptr

(DWORD*)((DWORD)new_data.Stretch_Data

(DWORD)new_data.my_section[new_data.my_file-NumberOfSections

GAP

(DWORD)new_data.Stretch_Data;memcpy_s(new_data_ptr,

import_table_size,

import_table_size);//修改导入表的入口地址和大小new_data.my_Data_Directory[1]-VirtualAddress

(DWORD)new_data_ptr-(DWORD)new_data.Stretch_Data;new_data.my_Data_Directory[1]-Size0x3c;//新增导入表PIMAGE_IMPORT_DESCRIPTOR

new_import_ptr2(PIMAGE_IMPORT_DESCRIPTOR)((DWORD)new_data_ptr

import_table_size);new_import_ptr2-FirstThunk

(DWORD)nullptr;new_import_ptr2-TimeDateStamp

0;new_import_ptr2-OriginalFirstThunk

(DWORD)nullptr;new_import_ptr2-ForwarderChain

0;//让FirstThunk指向自己伪造的IAT表让OriginalFirstThunk指向伪造的INT表PIMAGE_IMPORT_BY_NAME

(PIMAGE_IMPORT_BY_NAME)((DWORD)new_data_ptr3*0X140X10

);//指向新的空间PIMAGE_IMPORT_BY_NAME

temp_by_name_ptr

new_data_import_by_name;new_data_import_by_name-Hint

0;strcpy_s(new_data_import_by_name-Name,

0x5,

(PIMAGE_IMPORT_BY_NAME)((DWORD)new_data_import_by_name

0x7);strcpy_s((PCHAR)((DWORD)new_data_import_by_name),

0x9,

(DWORD)new_data_import_by_name-(DWORD)new_data.Stretch_Data;new_data_import_by_name

(PIMAGE_IMPORT_BY_NAME)((DWORD)new_data_import_by_name

thunk_ptr

(IMAGE_THUNK_DATA32*)((DWORD)new_data_ptr

0x14);thunk_ptr-u1.AddressOfData

(DWORD)new_data.Stretch_Data;new_import_ptr2-FirstThunk

(DWORD)thunk_ptr

(DWORD)new_data.Stretch_Data;thunk_ptr

(IMAGE_THUNK_DATA32*)((DWORD)thunk_ptr

0X8);thunk_ptr-u1.AddressOfData

(DWORD)new_data.Stretch_Data;new_import_ptr2-OriginalFirstThunk

(DWORD)thunk_ptr

(DWORD)new_data.Stretch_Data;//缩小保存FILE*

my_dll;Shrink_PE(new_data);Analyze_PE(new_data,

3);DWORD

_msize(new_data.Shrink_Data);if

(fopen_s(my_dll,

0){fwrite(new_data.Shrink_Data,

Size,

my_dos;//dos头结构PIMAGE_FILE_HEADER

my_file;//file结构PIMAGE_OPTIONAL_HEADER32

my_optional;//可选PE头结构PIMAGE_SECTION_HEADER*

my_section;//节表结构PIMAGE_DATA_DIRECTORY*

my_Data_Directory;//数据目录结构//0.导出表

1.导入表

my_Export_Name[50][30];//导出表的名字PIMAGE_EXPORT_DIRECTORY

my_Export_Directory;

//指向导出表中函数的地址PIMAGE_BASE_RELOCATION

//指向重定位表的数组PIMAGE_IMPORT_DESCRIPTOR*

my_Import_Directory;

nullptr;//节表结构my_Data_Directory

nullptr;

//指向缩小PE结构的内容Import_Directory_num

0;}~Data(){if

nullptr){free(Before_Stretch_Data);Before_Stretch_Data

nullptr;}if

nullptr){free(Stretch_Data);Stretch_Data

nullptr;}if

nullptr){free(Shrink_Data);Shrink_Data

nullptr;}}VOID

Data::Copy_Before_Strectch_Data(Data

my_data)

_msize(my_data.Before_Stretch_Data);memcpy_s(this-Before_Stretch_Data,

size,

my_data);//新增节非扩大节并写入新的exe文件中VOID

Expand_Section(Data

Print_IMAGE_DATA_DIRECTORY(Data

my_data);

PE::Import_Table_Injection(Data

my_data)

sizeof(IMAGE_IMPORT_DESCRIPTOR);DWORD

dll_size

my_data.my_optional-SizeOfImagedll_size;Data

new

char[new_data_size];memset(new_data.Stretch_Data,

new_data_size);DWORD

_msize(new_data.Stretch_Data);memcpy_s(new_data.Stretch_Data,

new_data_size,

my_data.my_optional-SizeOfImage);//修改节的属性Analyze_PE(new_data,

2);new_data.my_file-NumberOfSections

2);//必须再分析一次否则Remove_Relocation_Data.my_section[Remove_Relocation_Data.my_file-NumberOfSections

1]会报错new_data.my_optional-SizeOfImage

new_data_size;new_data.my_section[new_data.my_file-NumberOfSections

1]-Characteristics

my_data.my_section[0]-Characteristics;new_data.my_section[new_data.my_file-NumberOfSections

1]-Misc.VirtualSize

real_dll_size;memcpy_s(new_data.my_section[new_data.my_file-NumberOfSections

1]-Name,

7);new_data.my_section[new_data.my_file-NumberOfSections

my_data.my_section[0]-NumberOfLinenumbers;new_data.my_section[new_data.my_file-NumberOfSections

my_data.my_section[0]-NumberOfRelocations;new_data.my_section[new_data.my_file-NumberOfSections

my_data.my_section[0]-PointerToLinenumbers;new_data.my_section[new_data.my_file-NumberOfSections

1]-PointerToRawData

my_data.my_section[my_data.my_file-NumberOfSections

1]-PointerToRawData

my_data.my_section[my_data.my_file-NumberOfSections

1]-SizeOfRawData;new_data.my_section[new_data.my_file-NumberOfSections

my_data.my_section[0]-PointerToRelocations;new_data.my_section[new_data.my_file-NumberOfSections

1]-SizeOfRawData

size_of_rawdata;new_data.my_section[new_data.my_file-NumberOfSections

1]-VirtualAddress

my_data.my_section[my_data.my_file-NumberOfSections

1]-VirtualAddress

Section_Align(my_data.my_section[my_data.my_file-NumberOfSections

1]-Misc.VirtualSize,

my_data);cou***xRva_To_Foa(0x10eac,

new_data)endl;cout

sizeof(IMAGE_IMPORT_DESCRIPTOR);DWORD*

import_table_ptr

(DWORD*)my_data.my_Import_Directory[0];DWORD*

new_data_ptr

(DWORD*)((DWORD)new_data.Stretch_Data

(DWORD)new_data.my_section[new_data.my_file-NumberOfSections

GAP

(DWORD)new_data.Stretch_Data;memcpy_s(new_data_ptr,

import_table_size,

import_table_size);//修改导入表的入口地址和大小new_data.my_Data_Directory[1]-VirtualAddress

(DWORD)new_data_ptr-(DWORD)new_data.Stretch_Data;new_data.my_Data_Directory[1]-Size0x3c;//新增导入表PIMAGE_IMPORT_DESCRIPTOR

new_import_ptr2(PIMAGE_IMPORT_DESCRIPTOR)((DWORD)new_data_ptr

import_table_size);new_import_ptr2-FirstThunk

(DWORD)nullptr;new_import_ptr2-TimeDateStamp

0;new_import_ptr2-OriginalFirstThunk

(DWORD)nullptr;new_import_ptr2-ForwarderChain

0;//让FirstThunk指向自己伪造的IAT表让OriginalFirstThunk指向伪造的INT表PIMAGE_IMPORT_BY_NAME

(PIMAGE_IMPORT_BY_NAME)((DWORD)new_data_ptr3*0X140X10

);//指向新的空间PIMAGE_IMPORT_BY_NAME

temp_by_name_ptr

new_data_import_by_name;new_data_import_by_name-Hint

0;strcpy_s(new_data_import_by_name-Name,

0x5,

(PIMAGE_IMPORT_BY_NAME)((DWORD)new_data_import_by_name

0x7);strcpy_s((PCHAR)((DWORD)new_data_import_by_name),

0x9,

(DWORD)new_data_import_by_name-(DWORD)new_data.Stretch_Data;new_data_import_by_name

(PIMAGE_IMPORT_BY_NAME)((DWORD)new_data_import_by_name

thunk_ptr

(IMAGE_THUNK_DATA32*)((DWORD)new_data_ptr

0x14);thunk_ptr-u1.AddressOfData

(DWORD)new_data.Stretch_Data;new_import_ptr2-FirstThunk

(DWORD)thunk_ptr

(DWORD)new_data.Stretch_Data;thunk_ptr

(IMAGE_THUNK_DATA32*)((DWORD)thunk_ptr

0X8);thunk_ptr-u1.AddressOfData

(DWORD)new_data.Stretch_Data;new_import_ptr2-OriginalFirstThunk

(DWORD)thunk_ptr

(DWORD)new_data.Stretch_Data;//缩小保存FILE*

my_dll;Shrink_PE(new_data);Analyze_PE(new_data,

3);DWORD

_msize(new_data.Shrink_Data);if

(fopen_s(my_dll,

0){fwrite(new_data.Shrink_Data,

Size,

my_data.my_Import_Directory[i];if

0){cout

-----------------------------------------------------------------------------

endl;}else{cout

(PCHAR)(temp_import_ptr-Name(DWORD)my_data.Stretch_Data)

已经绑定不需要由编译器修复IAT

-----------------------------------------------------------------------------

endl;}}PIMAGE_BOUND_IMPORT_DESCRIPTOR

nullptr;if

(my_data.my_Data_Directory[11]-VirtualAddress

(PIMAGE_BOUND_IMPORT_DESCRIPTOR)((DWORD)my_data.my_Data_Directory[11]-VirtualAddress

(DWORD)my_data.Stretch_Data);}else{cout

该应用程序没有绑定导入表

(*(DWORD*)temp_bound_import_ptr

0){if

(temp_bound_import_ptr-TimeDateStamp

my_data.my_file-TimeDateStamp){cout

DLL:(PCHAR)(temp_bound_import_ptr-OffsetModuleNametemp_bound_import_ptr)PE头的时间戳和绑定导出表的时间戳不一致需要进行IAT重定位

endl;}else{DWORD*

(DWORD*)((DWORD)my_data.Stretch_Data

(DWORD)temp_bound_import_ptr-OffsetModuleName);cout

(PCHAR)temp_name_ptr

temp_bound_import_ptr-NumberOfModuleForwarderRefs

endl

temp_bound_import_ptr-NumberOfModuleForwarderRefs;

temp_ref_ptr

(PIMAGE_BOUND_FORWARDER_REF)((DWORD)temp_bound_import_ptr

0x8)

(PCHAR)((DWORD)my_data.Stretch_Data

(DWORD)temp_ref_ptr-OffsetModuleName)

endl;}cout

(PIMAGE_BOUND_IMPORT_DESCRIPTOR)((DWORD)temp_bound_import_ptr

0x8(DWORD)temp_bound_import_ptr-NumberOfModuleForwarderRefs

0x8);}

(PCHAR)((DWORD)my_data.my_Import_Directory[i]-Name

endl;DWORD*

(DWORD*)((DWORD)my_data.my_Import_Directory[i]-OriginalFirstThunk

(DWORD)my_data.Stretch_Data);int

count

(PCHAR)((DWORD)my_data.my_Import_Directory[i]-Name

endl;DWORD*

(DWORD*)((DWORD)my_data.my_Import_Directory[i]-FirstThunk

(DWORD)my_data.Stretch_Data);int

count

(PCHAR)(my_data.my_Import_Directory[i]-Name(DWORD)my_data.Stretch_Data)

pimage_thunk_data32

(PIMAGE_THUNK_DATA32)((my_data.my_Import_Directory[0]-OriginalFirstThunk

(DWORD)my_data.Stretch_Data));for

(int

((DWORD)pimage_thunk_data32-u1.AddressOfData

1){cout

(pimage_thunk_data32-u1.AddressOfData

0x7FFF)

((DWORD)pimage_thunk_data32-u1.AddressOfData

0){cout

(PCHAR)(pimage_thunk_data32-u1.AddressOfData

endl;}else

((DWORD)pimage_thunk_data32-u1.AddressOfData

0){break;}pimage_thunk_data32;}}

}VOID

(PIMAGE_IMPORT_DESCRIPTOR)my_data.my_Data_Directory[1];my_data.my_Import_Directory

new

PIMAGE_IMPORT_DESCRIPTOR[100];Temp_Ptr

(PIMAGE_IMPORT_DESCRIPTOR)(*(DWORD*)Temp_Ptr

(DWORD)my_data.Stretch_Data);int

0;for

0){break;}my_data.my_Import_Directory[i]

Temp_Ptr;Temp_Ptr

(PIMAGE_IMPORT_DESCRIPTOR)((DWORD)Temp_Ptr

sizeof(DWORD));}my_data.Import_Directory_num

i;return;

(LPVOID)((DWORD)my_data.my_Data_Directory[5]-VirtualAddress

(DWORD)my_data.Stretch_Data);PIMAGE_BASE_RELOCATION

relocation_ptr

(PIMAGE_BASE_RELOCATION)Temp_Ptr;while

(TRUE){if

relocation_ptr-SizeOfBlock;relocation_ptr

(PIMAGE_BASE_RELOCATION)((DWORD)relocation_ptr(DWORD)relocation_ptr-SizeOfBlock);}DWORD

Real_Size

File_Align(Relocation_Data_Size,

Section_Align(Relocation_Data_Size,

my_data);Remove_Relocation_Data.Stretch_Data

new

my_data.my_optional-SizeOfImage];if

(Remove_Relocation_Data.Stretch_Data

nullptr){cout

Remove_Relocation_Data.Stretch_Data分配空间失败

endl;return;}memcpy_s(Remove_Relocation_Data.Stretch_Data,

Relocation_Data_Size

my_data.my_optional-SizeOfImage,

my_data.my_optional-SizeOfImage);//现在要将新的节设置好//

被坑了好久记得在对应节填上数据否则会因为数据为空而不能运行Temp_Ptr

(LPVOID)((DWORD)Remove_Relocation_Data.Stretch_Data

(DWORD)my_data.my_optional-SizeOfImage);memset(Temp_Ptr,

Relocation_Data_Size);Analyze_PE(Remove_Relocation_Data,

2);Remove_Relocation_Data.my_file-NumberOfSections

1;Analyze_PE(Remove_Relocation_Data,

2);//必须再分析一次否则Remove_Relocation_Data.my_section[Remove_Relocation_Data.my_file-NumberOfSections

1]会报错Remove_Relocation_Data.my_optional-SizeOfImage

Relocation_Data_Size;Remove_Relocation_Data.my_section[Remove_Relocation_Data.my_file-NumberOfSections

1]-Characteristics

my_data.my_section[0]-Characteristics;Remove_Relocation_Data.my_section[Remove_Relocation_Data.my_file-NumberOfSections

1]-Misc.VirtualSize

Relocation_Data_Size;memcpy_s(Remove_Relocation_Data.my_section[Remove_Relocation_Data.my_file-NumberOfSections

1]-Name,

7);Remove_Relocation_Data.my_section[Remove_Relocation_Data.my_file-NumberOfSections

my_data.my_section[0]-NumberOfLinenumbers;Remove_Relocation_Data.my_section[Remove_Relocation_Data.my_file-NumberOfSections

my_data.my_section[0]-NumberOfRelocations;Remove_Relocation_Data.my_section[Remove_Relocation_Data.my_file-NumberOfSections

my_data.my_section[0]-PointerToLinenumbers;Remove_Relocation_Data.my_section[Remove_Relocation_Data.my_file-NumberOfSections

1]-PointerToRawData

my_data.my_section[my_data.my_file-NumberOfSections

1]-PointerToRawData

my_data.my_section[my_data.my_file-NumberOfSections

1]-SizeOfRawData;Remove_Relocation_Data.my_section[Remove_Relocation_Data.my_file-NumberOfSections

my_data.my_section[0]-PointerToRelocations;Remove_Relocation_Data.my_section[Remove_Relocation_Data.my_file-NumberOfSections

1]-SizeOfRawData

SizeOfRawData;Remove_Relocation_Data.my_section[Remove_Relocation_Data.my_file-NumberOfSections

1]-VirtualAddress

my_data.my_section[my_data.my_file-NumberOfSections

1]-VirtualAddress

Section_Align(my_data.my_section[my_data.my_file-NumberOfSections

1]-Misc.VirtualSize,

(LPVOID)((DWORD)my_data.my_Data_Directory[5]-VirtualAddress

Real_Size);Remove_Relocation_Data.my_Data_Directory[5]-VirtualAddress

(DWORD)my_data.my_optional-SizeOfImage;FILE*

my_file;Shrink_PE(Remove_Relocation_Data);Analyze_PE(Remove_Relocation_Data,

1);DWORD

_msize(Remove_Relocation_Data.Shrink_Data);if

(fopen_s(my_file,

0){fwrite(Remove_Relocation_Data.Shrink_Data,

Size,

my_data.my_Export_Directory-NumberOfFunctions

sizeof(DWORD)

my_data.my_Export_Directory-NumberOfNames

sizeof(WORD)

my_data.my_Export_Directory-NumberOfNames

sizeof(DWORD);for

my_data.my_Export_Directory-NumberOfNames;

i){Export_Size

strlen(my_data.my_Export_Name[i]);}Export_Size

my_data);DWORD

my_data.my_optional-SizeOfImage;Data

Remove_Export_Data;Remove_Export_Data.Stretch_Data

new

(Remove_Export_Data.Stretch_Data

nullptr){cout

endl;}memcpy_s(Remove_Export_Data.Stretch_Data,

Total_Size,

my_data.my_optional-SizeOfImage);LPVOID

Temp_Ptr

(LPVOID)((DWORD)Remove_Export_Data.Stretch_Data

my_data.my_optional-SizeOfImage);//这里是指向新的节//现在要将新的节设置好//

被坑了好久记得在对应节填上数据否则会因为数据为空而不能运行memset(Temp_Ptr,

Export_Size);Analyze_PE(Remove_Export_Data,

2);Remove_Export_Data.my_file-NumberOfSections;Remove_Export_Data.my_optional-SizeOfImage

Export_Size;Analyze_PE(Remove_Export_Data,

2);

//可以分析到新的节表//开始修改节的属性Remove_Export_Data.my_section[Remove_Export_Data.my_file-NumberOfSections

1]-Characteristics

my_data.my_section[0]-Characteristics;Remove_Export_Data.my_section[Remove_Export_Data.my_file-NumberOfSections

1]-Misc.VirtualSize

Export_Size;memcpy_s(Remove_Export_Data.my_section[Remove_Export_Data.my_file-NumberOfSections

1]-Name,

remove,7);Remove_Export_Data.my_section[Remove_Export_Data.my_file-NumberOfSections

my_data.my_section[0]-NumberOfLinenumbers;Remove_Export_Data.my_section[Remove_Export_Data.my_file-NumberOfSections

my_data.my_section[0]-NumberOfRelocations;Remove_Export_Data.my_section[Remove_Export_Data.my_file-NumberOfSections

my_data.my_section[0]-PointerToLinenumbers;Remove_Export_Data.my_section[Remove_Export_Data.my_file-NumberOfSections

1]-PointerToRawData

my_data.my_section[my_data.my_file-NumberOfSections-1]-PointerToRawData

my_data.my_section[my_data.my_file-NumberOfSections

1]-SizeOfRawData;Remove_Export_Data.my_section[Remove_Export_Data.my_file-NumberOfSections

my_data.my_section[0]-PointerToRelocations;Remove_Export_Data.my_section[Remove_Export_Data.my_file-NumberOfSections

1]-SizeOfRawData

Export_Size;Remove_Export_Data.my_section[Remove_Export_Data.my_file-NumberOfSections

1]-VirtualAddress

my_data.my_section[my_data.my_file-NumberOfSections

1]-VirtualAddress

Section_Align(my_data.my_section[my_data.my_file-NumberOfSections

1]-SizeOfRawData,my_data);Print_ExportTable(Remove_Export_Data);//开始移动导出表的信息memcpy_s(Temp_Ptr,

sizeof(DWORD)

my_data.my_Export_Directory-NumberOfFunctions,

(LPVOID)(my_data.my_Export_Directory-AddressOfFunctions(DWORD)my_data.Stretch_Data),

sizeof(DWORD)

my_data.my_Export_Directory-NumberOfFunctions);Remove_Export_Data.my_Export_Directory-AddressOfFunctions

(DWORD)Temp_Ptr-(DWORD)Remove_Export_Data.Stretch_Data;Temp_Ptr

sizeof(DWORD)

my_data.my_Export_Directory-NumberOfFunctions);memcpy_s(Temp_Ptr,

sizeof(WORD)

my_data.my_Export_Directory-NumberOfNames,

(LPVOID)(my_data.my_Export_Directory-AddressOfNameOrdinals

sizeof(WORD)

my_data.my_Export_Directory-NumberOfNames);Remove_Export_Data.my_Export_Directory-AddressOfNameOrdinals

(DWORD)Temp_Ptr

(DWORD)Remove_Export_Data.Stretch_Data;Temp_Ptr

sizeof(WORD)

my_data.my_Export_Directory-NumberOfNames);memcpy_s(Temp_Ptr,

sizeof(DWORD)

my_data.my_Export_Directory-AddressOfNames,

(LPVOID)(my_data.my_Export_Directory-AddressOfNames

sizeof(DWORD)

my_data.my_Export_Directory-NumberOfNames);Remove_Export_Data.my_Export_Directory-AddressOfNames

(DWORD)Temp_Ptr

(DWORD)Remove_Export_Data.Stretch_Data;Temp_Ptr

sizeof(DWORD)

my_data.my_Export_Directory-AddressOfNames);FILE*

my_file;Shrink_PE(Remove_Export_Data);DWORD

Size

_msize(Remove_Export_Data.Shrink_Data);if

(fopen_s(my_file,

0){fwrite(Remove_Export_Data.Shrink_Data,

Size,

(DWORD)my_data.my_Data_Directory[5]-VirtualAddress(DWORD)my_data.Stretch_Data;int

count

-----------------------------------------------------

endl;my_data.Relocation_Table[i]

(PIMAGE_BASE_RELOCATION)Temp_ptr;my_data.Relocation_Table[i]-VirtualAddress

*(DWORD*)Temp_ptr;my_data.Relocation_Table[i]-SizeOfBlock

*(DWORD*)(Temp_ptr

(my_data.Relocation_Table[i]-SizeOfBlock

0x8)

my_data.Relocation_Table[i]-VirtualAddress

(*(Temp_ptr2)

my_data.Relocation_Table[i]-SizeOfBlock-0x8;if

(*(DWORD*)Temp_ptr

*(DWORD*)(Temp_ptr1)0){break;}}}VOID

PE::GetFunctionAddrByOrdinal(Data

my_data,

(DWORD)((DWORD)my_data.my_Export_Directory-AddressOfNameOrdinals

(DWORD)my_data.Stretch_Data);for

(int

my_data.my_Export_Directory-NumberOfNames;

i){if

my_data.my_Export_Directory-Base

ordinal){cout

my_data.Export_AddressOfFunction[i]

endl;return;}AddressOfNames_ptr

(DWORD)((char*)AddressOfNames_ptr

2);}cout

my_data.my_Export_Directory-NumberOfNames;

i){if

my_data.my_Export_Name[i])){cout

endl;break;}if

my_data.my_Export_Directory-NumberOfNames

1){cout

my_data.Export_AddressOfFunction[i]

endl;}void

(PIMAGE_EXPORT_DIRECTORY)((DWORD)my_data.my_Data_Directory[0]-VirtualAddress

(DWORD)my_data.Stretch_Data);my_data.my_Export_Directory

(DWORD)((DWORD)my_export_directory_ptr-AddressOfFunctions

(DWORD)my_data.Stretch_Data);DWORD

AddressOfNames_ptr

(DWORD)((DWORD)my_export_directory_ptr-AddressOfNames

(DWORD)my_data.Stretch_Data);DWORD

(DWORD)((DWORD)my_export_directory_ptr-AddressOfNameOrdinals

(DWORD)my_data.Stretch_Data);cout

---------------AddressOfFunctions------------------

endl;int

my_export_directory_ptr-NumberOfFunctions;for

(int

*((DWORD*)AddressOfFunctions_ptr)

endl;my_data.Export_AddressOfFunction[i]

*((DWORD*)AddressOfFunctions_ptr);AddressOfFunctions_ptr

0x4;while

(*((DWORD*)AddressOfFunctions_ptr)

0x4;}}cout

---------------------Names------------------

endl;number

my_export_directory_ptr-NumberOfNames;for

(int

i){strcpy_s(my_data.my_Export_Name[i],

(PCHAR)(*(DWORD*)AddressOfNames_ptr

(DWORD)my_data.Stretch_Data));cout

(PCHAR)(*(DWORD*)AddressOfNames_ptr

0x4;}cout

----------------------NameOrdinals---------------

endl;cout

my_data.my_optional-SizeOfHeaders){return

(Rva_Offset

my_data.my_section[index]-VirtualAddress){if

(index

my_data.my_file-NumberOfSections

Section_Offset

my_data.my_section[index]-VirtualAddress;return

my_data.my_section[index]-PointerToRawData

Section_Offset;}

PE::Analyze_Data_Directory(Data

my_data)

nullptr;my_data.my_Data_Directory

(PIMAGE_DATA_DIRECTORY*)malloc(16

sizeof(PIMAGE_DATA_DIRECTORY));void*

Temp_ptr

my_data.my_optional-DataDirectory;for

(int

i){my_data.my_Data_Directory[i]

(PIMAGE_DATA_DIRECTORY)Temp_ptr;Temp_ptr

(char*)Temp_ptr

PE::Print_IMAGE_DATA_DIRECTORY(Data

my_data)

{IMAGE_DIRECTORY_ENTRY_EXPORT,IMAGE_DIRECTORY_ENTRY_IMPORT,IMAGE_DIRECTORY_ENTRY_RESOURCE,IMAGE_DIRECTORY_ENTRY_EXCEPTION,IMAGE_DIRECTORY_ENTRY_SECURITY,IMAGE_DIRECTORY_ENTRY_BASERELOC,IMAGE_DIRECTORY_ENTRY_DEBUG,IMAGE_DIRECTORY_ENTRY_COPYRIGHT,IMAGE_DIRECTORY_ENTRY_GLOBALPTR,IMAGE_DIRECTORY_ENTRY_TLS,IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG,IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT,IMAGE_DIRECTORY_ENTRY_IAT,IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT,IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR,RESERVED};for

(int

my_data.my_Data_Directory[i]-Size

endl;cout

my_data.my_Data_Directory[i]-VirtualAddress

endl;cout

------------------------------------------------------------------------

endl;}return;

MAX(my_data.my_section[my_data.my_file-NumberOfSections

1]-SizeOfRawData,

my_data.my_section[my_data.my_file-NumberOfSections

Size

my_data.my_section[my_data.my_file-NumberOfSections

1]-VirtualAddress

Section_Align(my_data.my_optional-SizeOfHeaders,

my_data)

MAX(my_data.my_section[0]-SizeOfRawData,

my_data.my_section[0]-Misc.VirtualSize);Data

Comebine_Data;int

(void*)malloc(temp_size);memset(Comebine_Data.Stretch_Data,

Size);temp_size

_msize(my_data.Stretch_Data);memcpy_s(Comebine_Data.Stretch_Data,

temp_size,

temp_size);Analyze_PE(Comebine_Data,

2);void*

(char*)Comebine_Data.Stretch_Data

Max

my_data.my_section[my_data.my_file-NumberOfSections

1]-VirtualAddress;memcpy_s(temp_ptr,

MAX(my_data.my_section[0]-SizeOfRawData,

my_data.my_section[0]-Misc.VirtualSize),

my_data.my_section[0]-VirtualAddress

MAX(my_data.my_section[0]-SizeOfRawData,

my_data.my_section[0]-Misc.VirtualSize));Comebine_Data.my_optional-SizeOfImage

Section_Align(MAX(my_data.my_section[0]-SizeOfRawData,

my_data.my_section[0]-Misc.VirtualSize),

my_data);Comebine_Data.my_section[my_data.my_file-NumberOfSections

1]-SizeOfRawData

File_Align(MAX(my_data.my_section[0]-SizeOfRawData,

my_data.my_section[0]-Misc.VirtualSize),

my_data);Comebine_Data.my_section[my_data.my_file-NumberOfSections

1]-Misc.VirtualSize

Section_Align(Comebine_Data.my_section[my_data.my_file-NumberOfSections

1]-Misc.VirtualSize,

Section_Align(MAX(my_data.my_section[0]-SizeOfRawData,

my_data.my_section[0]-Misc.VirtualSize),

my_data);FILE*

endl;return;}Shrink_PE(Comebine_Data);Analyze_PE(Comebine_Data,

3);fwrite(Comebine_Data.Shrink_Data,

_msize(Comebine_Data.Shrink_Data),

my_file);cout

{this-Stretch_PE(my_data);unsigned

Size

Section_Align(MAX(my_data.my_section[0]-SizeOfRawData,

my_data.my_section[0]-Misc.VirtualSize),

my_data);Data

Expand_Data;Expand_Data.Stretch_Data

(void*)malloc(Size);memset(Expand_Data.Stretch_Data,

Size);memcpy_s(Expand_Data.Stretch_Data,

_msize(my_data.Stretch_Data));Analyze_PE(Expand_Data,

2);Expand_Data.my_section[my_data.my_file-NumberOfSections

1]-SizeOfRawData

Section_Align(MAX(my_data.my_section[0]-SizeOfRawData,

my_data.my_section[0]-Misc.VirtualSize),

my_data)

Section_Align(MAX(my_data.my_section[my_data.my_file-NumberOfSections

1]-SizeOfRawData,

my_data.my_section[my_data.my_file-NumberOfSections

my_data);Expand_Data.my_section[my_data.my_file-NumberOfSections

1]-Misc.VirtualSize

Expand_Data.my_section[my_data.my_file-NumberOfSections

1]-SizeOfRawData;Expand_Data.my_optional-SizeOfImage

Section_Align(MAX(my_data.my_section[0]-SizeOfRawData,

my_data.my_section[0]-Misc.VirtualSize),

my_data);void*

(char*)Expand_Data.Stretch_Data

Expand_Data.my_section[Expand_Data.my_file-NumberOfSections

1]-VirtualAddress

Section_Align(MAX(my_data.my_section[Expand_Data.my_file-NumberOfSections

1]-SizeOfRawData,

my_data.my_section[Expand_Data.my_file-NumberOfSections

my_data);int

Section_Align(MAX(my_data.my_section[0]-SizeOfRawData,

my_data.my_section[0]-Misc.VirtualSize),

my_data);void*

my_data.my_section[0]-VirtualAddress;memcpy_s(Temp_Ptr,

temp_size,

temp_size);Shrink_PE(Expand_Data);FILE*

my_file;if

_msize(Expand_Data.Shrink_Data);fwrite(Expand_Data.Shrink_Data,

Size,

my_data.my_optional-SectionAlignment){i;}return

my_data.my_optional-SectionAlignment;}DWORD

PE::File_Align(DWORD

my_data.my_optional-FileAlignment){i;}return

my_data.my_optional-FileAlignment;

}void

//Size是新文件的大小是原来的文件大小加上.VirtualSize和SizeOfRawData较大的那个Size

my_data.my_optional-SizeOfHeaders;for

(int

my_data.my_file-NumberOfSections;

i){Size

my_data.my_section[i]-SizeOfRawData;}Size

my_data.my_section[0]-SizeOfRawData;//这是最终新的文件的大小Data

New_Data;New_Data.Before_Stretch_Data

(void*)malloc(Size

1);memset(New_Data.Before_Stretch_Data,

Size);memcpy_s(New_Data.Before_Stretch_Data,

Size,

my_data.my_section[0]-SizeOfRawData);//将原来的文件复制过来Analyze_PE(New_Data,

1);//让New_Data的dos,file,optional,section有数据//复制新的节表void*

Temp_ptr1

(char*)my_data.Before_Stretch_Data

0x98

my_data.my_file-SizeOfOptionalHeader;void*

Temp_ptr2

(char*)New_Data.Before_Stretch_Data

0x98

my_data.my_file-SizeOfOptionalHeader

my_data.my_file-NumberOfSections

0x28,

(char*)my_data.Before_Stretch_Data

my_data.my_optional-SizeOfHeaders;//指向.text段Temp_ptr2

(char*)New_Data.Before_Stretch_Data

Size

my_data.my_section[0]-SizeOfRawData;memcpy_s(Temp_ptr2,

my_data.my_section[0]-SizeOfRawData,

Temp_ptr1,

my_data.my_section[0]-SizeOfRawData);//复制完.text段作为新增节//接下来要改Header的各项数据New_Data.my_file-NumberOfSections;New_Data.my_optional-SizeOfImage

my_data.my_section[0]-SizeOfRawData;Analyze_PE(New_Data,

1);New_Data.my_section[New_Data.my_file-NumberOfSections

1]-PointerToRawData

New_Data.my_section[New_Data.my_file-NumberOfSections

2]-PointerToRawData

New_Data.my_section[New_Data.my_file-NumberOfSections

2]-SizeOfRawData;int

(New_Data.my_section[New_Data.my_file-NumberOfSections

2]-Misc.VirtualSize

New_Data.my_section[New_Data.my_file-NumberOfSections

New_Data.my_section[New_Data.my_file-NumberOfSections

New_Data.my_section[New_Data.my_file-NumberOfSections

size

my_data.my_optional-SectionAlignment

my_data.my_optional-SectionAlignment;New_Data.my_section[New_Data.my_file-NumberOfSections

1]-VirtualAddress

New_Data.my_section[New_Data.my_file-NumberOfSections

2]-VirtualAddress

0){fwrite(New_Data.Before_Stretch_Data,

Size,

endl;return;}else{//获取文件的大小cout

打开文件成功

ftell(datafile);fseek(datafile,

SEEK_SET);if

endl;return;}//申请内存空间把文件内容保存下来my_data.Before_Stretch_Data

(void*)malloc(size

(fread_s(my_data.Before_Stretch_Data,

size,

(DWORD*)data.Before_Stretch_Data;data.my_dos

(PIMAGE_DOS_HEADER)Temp_ptr;Temp_ptr

(DWORD*)((char*)data.Before_Stretch_Data

data.my_dos-e_lfanew);Temp_ptr;data.my_file

(PIMAGE_FILE_HEADER)Temp_ptr;Temp_ptr

(PIMAGE_OPTIONAL_HEADER)Temp_ptr;Temp_ptr

(DWORD*)((char*)data.my_optional

data.my_file-SizeOfOptionalHeader);data.my_section

(PIMAGE_SECTION_HEADER*)malloc(sizeof(PIMAGE_SECTION_HEADER)

data.my_file-NumberOfSections);memset(data.my_section,

data.my_file-NumberOfSections);for

(int

(PIMAGE_SECTION_HEADER)Temp_ptr;Temp_ptr

0x28);}Analyze_Data_Directory(data);return;}cout

分析PE结构失败

(DWORD*)data.Stretch_Data;data.my_dos

(PIMAGE_DOS_HEADER)Temp_ptr;Temp_ptr

(DWORD*)((char*)data.Stretch_Data

data.my_dos-e_lfanew);Temp_ptr;data.my_file

(PIMAGE_FILE_HEADER)Temp_ptr;Temp_ptr

(PIMAGE_OPTIONAL_HEADER)Temp_ptr;Temp_ptr

(DWORD*)((char*)data.my_optional

data.my_file-SizeOfOptionalHeader);data.my_section

(PIMAGE_SECTION_HEADER*)malloc(sizeof(PIMAGE_SECTION_HEADER)

data.my_file-NumberOfSections);for

(int

(PIMAGE_SECTION_HEADER)Temp_ptr;Temp_ptr

0x28);}Analyze_Data_Directory(data);PIMAGE_EXPORT_DIRECTORY

(PIMAGE_EXPORT_DIRECTORY)((DWORD)data.my_Data_Directory[0]-VirtualAddress

(DWORD)data.Stretch_Data);data.my_Export_Directory

(DWORD)((DWORD)my_export_directory_ptr-AddressOfFunctions

(DWORD)data.Stretch_Data);DWORD

AddressOfNames_ptr

(DWORD)((DWORD)my_export_directory_ptr-AddressOfNames

(DWORD)data.Stretch_Data);DWORD

(DWORD)((DWORD)my_export_directory_ptr-AddressOfNameOrdinals

(DWORD)data.Stretch_Data);Analyze_Import_Table(data);return;}cout

分析PE结构失败

(DWORD*)data.Shrink_Data;data.my_dos

(PIMAGE_DOS_HEADER)Temp_ptr;Temp_ptr

(DWORD*)((char*)data.Shrink_Data

data.my_dos-e_lfanew);Temp_ptr;data.my_file

(PIMAGE_FILE_HEADER)Temp_ptr;Temp_ptr

(PIMAGE_OPTIONAL_HEADER)Temp_ptr;Temp_ptr

(DWORD*)((char*)data.my_optional

data.my_file-SizeOfOptionalHeader);data.my_section

(PIMAGE_SECTION_HEADER*)malloc(sizeof(PIMAGE_SECTION_HEADER)

data.my_file-NumberOfSections);for

(int

(PIMAGE_SECTION_HEADER)Temp_ptr;Temp_ptr

0x28);}Analyze_Data_Directory(data);return;}cout

分析pe结构失败!

注意看PIMAGE_XXX_HEADER的定义它们本就是指向结构体的指针

void

my_data.my_optional-SizeOfImage;my_data.Stretch_Data

Memory_Size);memset(my_data.Stretch_Data,

Memory_Size);void*

my_data.Before_Stretch_Data;int

size_of_dos

my_data.my_file-SizeOfOptionalHeader;unsigned

Size_Of_Section

my_data.my_optional-SizeOfHeaders;//还未对齐memcpy_s(my_data.Stretch_Data,

Memory_Size,

my_data.Stretch_Data;//现在计算head头对齐后的大小int

Size

my_data.my_optional-SectionAlignment;Size_Of_Header

my_data.my_optional-SectionAlignment

Size;for

my_data.my_file-NumberOfSections;

i){temp_stretch_data

(void*)((char*)my_data.Stretch_Data

my_data.my_section[i]-VirtualAddress);temp_before_stretch_data_ptr

(void*)((char*)my_data.Before_Stretch_Data

my_data.my_section[i]-PointerToRawData);memcpy_s(temp_stretch_data,

my_data.my_section[i]-SizeOfRawData,

my_data.my_section[i]-SizeOfRawData);}cout

拉伸成功

my_data.my_section[my_data.my_file-NumberOfSections

1]-PointerToRawData

my_data.my_section[my_data.my_file-NumberOfSections

1]-SizeOfRawData;my_data.Shrink_Data

(void*)malloc(Size);memset(my_data.Shrink_Data,

Size);//从Stretch_Data缩小//复制Headsmemcpy_s(my_data.Shrink_Data,

my_data.my_optional-SizeOfHeaders,

my_data.my_optional-SizeOfHeaders);//复制节void*

temp_shrink_data_ptr

my_data.my_file-NumberOfSections;

(void*)((char*)my_data.Shrink_Data

my_data.my_section[i]-PointerToRawData);temp_stretch_data_ptr

(void*)((char*)my_data.Stretch_Data

my_data.my_section[i]-VirtualAddress);memcpy_s(temp_shrink_data_ptr,

my_data.my_section[i]-SizeOfRawData,

my_data.my_section[i]-SizeOfRawData);}cout

缩小成功

my_data;my_pe.Readfile(filename,

my_data);my_pe.Analyze_PE(my_data,

1);

sectionmy_pe.Stretch_PE(my_data);my_pe.Analyze_PE(my_data,

2);my_pe.Shrink_PE(my_data);my_pe.Analyze_Data_Directory(my_data);//my_pe.Print_IMAGE_DATA_DIRECTORY(my_data);//my_pe.Print_ExportTable(my_data);//cout

hex

endl;((void(*)())addr)();//调用//HMODULE

hDll

GetModuleHandleA(Dll1.dll);//my_pe.GetFunctionAddrByName(my_data,

(char*)Print);//my_pe.GetFunctionAddrByOrdinal(my_data,

14);//my_pe.Print_ExportTable(my_data);//cout

hex

endl;//my_pe.Print_Relocation(my_data);//cout

hex

endl;my_pe.Remove_Export_Table(my_data);//my_pe.Remove_Relocation(my_data);//my_pe.Analyze_Import_Table(my_data);//my_pe.Print_Import_Table(my_data);my_pe.Print_INT(my_data);my_pe.Print_IAT(my_data);my_pe.Print_BOUND_IMPORT(my_data);my_pe.Import_Table_Injection(my_data);return

有错请师父不吝指出万分感谢