资源简介
PE文件自动添加节区,并弹出一个简单的对话框(可以自己修改成其它的东西)
代码片段和文件信息
#include
#include
#include
#include
IMAGE_NT_HEADERS Nt_Header;
int main(int argc char *argv[])
{
printf(“ **********************************************************\n“);
printf(“ *******请先将原来的文件拷贝几份,以免丢失。***************\n“);
printf(“ **********************************************************\n\n\n“);
if(argc<=1)
{
printf(“ 错误提示:要输入文件路径(一次输一个)\n\n“);
exit(0);
}
FILE *fp = fopen(argv[1]“rb+“);
if(!fp)
{
perror(“unable to open file“);
return -1;
}
//long fileSize = (fseek(fp0SEEK_END)ftell(fp));
IMAGE_DOS_HEADER Dos_Header;
IMAGE_FILE_HEADER File_Header;
IMAGE_OPTIONAL_HEADER32 Option_Header;
IMAGE_SECTION_HEADER Section_Header;
//***************************************************
// 读取DOS Header
fread(&Dos_Headersizeof(Dos_Header)1fp);
DWORD p_Nt=Dos_Header.e_lfanew; //保存Nt头偏移
//读取 file_headr
fseek(fpp_Nt+4L0);
fread(&File_Headersizeof(File_Header)1fp);
WORD NumberOfSections=File_Header.NumberOfSections; //保存节表的个数
//读取 option_header
fseek(fpp_Nt+4+sizeof(File_Header)0);
fread(&Option_Headersizeof(Option_Header)1fp);
DWORD Imagebase=Option_Header.Imagebase;
DWORD AddressOfEntryPoint=Option_Header.AddressOfEntryPoint;
//节表所在的偏移 内存对齐 文件对齐 文件大小(内存中)
DWORD SectionAlignment=Option_Header.SectionAlignment; //内存对齐
DWORD FileAlignment=Option_Header.FileAlignment; //文件对齐
DWORD SizeOfImage=Option_Header.SizeOfImage; //文件大小
DWORD p_SectionTable=Dos_Header.e_lfanew+sizeof(Nt_Header); //节表偏移
DWORD P_NewSectionTable=p_SectionTable+NumberOfSections*sizeof(Section_Header); //新增的节表的偏移
//读取最后一个节表
fseek(fpp_SectionTable+(NumberOfSections-1)*sizeof(Section_Header)0);
fread(&Section_Headersizeof(Section_Header)1fp);
//定义新的变量
//定义新的变量
WORD New_NumberOfSections=NumberOfSections+1;
DWORD New_SizeOfImage=Option_Header.SizeOfImage+0x1000; //扩大0x1000
//新的节表
char Name[8]=“.MySect“;
DWORD New_VirtualSize=0x1000;
DWORD New_VirtualAddress=Section_Header.VirtualAddress+0x1000;
DWORD New_SizeOfRawData=0x1000;
DWORD New_PointerToRawData=Section_Header.PointerToRawData+0x1000;
DWORD New_PointerToRelocations=0;
DWORD New_PointerToLineNumbers=0;
WORD New_NumberOfRelocations=0;
WORD New_NumberOfLineNumbers=0;
DWORD New_Characteristics=0xE0000000;
//开始写入数据
//写节表个数
fseek(fpp_Nt+6L0);
fwrite(&New_NumberOfSections21fp);
//写文件大小
fseek(fpp_Nt+0x50L0);
fwrite(&New_SizeOfImage41fp);
//写节表
fseek(fpP_NewSectionTable0);
fwrite(Name81fp);
fwrite(&New_VirtualSize41fp);
fwrite(&New_VirtualAddress41fp);
fwrite(&New_SizeOfRawData41fp);
fwrite(&New_PointerToRawData41fp);
fwrite(&New_PointerToRelocations41fp);
fwrite(&New_PointerToLineNumbers41fp);
fwrite(&New_NumberOfRelocations21fp);
fwrite(&New_NumberOfLineNumbers21fp);
fwrite(&New_Characteristics41fp);
//找Imagebase和AddressOfEntryPoint
DWORD New_Address
属性 大小 日期 时间 名称
----------- --------- ---------- ----- ----
文件 5732 2017-11-28 16:52 PE节区添加\Section_Write.cpp
文件 180316 2017-11-28 16:52 PE节区添加\Section_Write.exe
目录 0 2017-12-03 00:27 PE节区添加\
评论
共有 条评论