闲来无事之--记用BAT(批处理脚本)实现文件下载功能（再续）

五.解决-打造

[THIS IS JMP S2]

现在我们再回头整理一下整个过程...结合这张表:

代码

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F 00000000   4D 5A 5B 00 00 00 00 00  00 00 00 00 00 00 00 00   MZ[............. 00000010   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................ 00000020   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................ 00000030   00 00 00 00 00 00 00 00  00 00 00 5D 40 00 00 00   ...........]@... 00000040   50 45 00 00 4C 01 02 00  00 00 00 00 00 00 00 00   PE..L........... 00000050   00 00 00 00 70 00 0F 01  0B 01 00 00 00 02 00 00   ....p........... 00000060   00 00 00 00 00 00 00 00  79 01 00 00 00 00 00 00   ........y....... 00000070   00 00 00 00 00 00 40 00  00 10 00 00 00 02 00 00   ......@......... 00000080   00 00 00 00 00 00 00 00  04 00 00 00 00 00 00 00   ................ 00000090   00 30 00 00 00 02 00 00  00 00 00 00 02 00 00 00   .0.............. 000000A0   00 01 00 00 00 00 00 00  00 01 00 00 00 10 00 00   ................ 000000B0   00 00 00 00 02 00 00 00  00 00 00 00 00 00 00 00   ................ 000000C0   28 11 00 00 28 00 00 00  00 00 00 00 00 00 00 00   (...(........... 000000D0   00 02 00 00 00 10 00 00  00 02 00 00 00 01 00 00   ................ 000000E0   00 00 00 00 00 00 00 00  00 00 00 00 60 00 00 60   ............`..` 000000F0   00 00 00 00 00 00 00 00  02 00 00 00 00 20 00 00   ............. .. 00000100   00 02 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................ 00000110   00 00 00 00 60 00 00 60  00 00 00 00 00 00 00 00   ....`..`........ 00000120   58 11 00 00 00 00 00 00  50 11 00 00 00 00 00 00   X.......P....... 00000130   00 00 00 00 6E 11 00 00  20 11 00 00 00 00 00 00   ....n... ....... 00000140   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................ 00000150   58 11 00 00 00 00 00 00  5B 00 00 00 00 00 00 00   ........[....... 00000160   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................ 00000170   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................ 00000180   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................ 00000190   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................ 000001A0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................ 000001B0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................ 000001C0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................ 000001D0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................ 000001E0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................ 000001E0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 5D   ...............]

这张PE文件数据图就是一个很大的"填空",除去重要的数据部分,我们可以随便写入数据的地方有2个(也就是两个大挂号挂起来的中间).

第一个是从地址00000002开始的,到地址0000003B结束的56字节.

第二个是从地址00000160开始的,到PE文件结尾的160字节.(也可以从000000158开始,这样就有168字节)

因为我们的程序很短,所以第二个168字节基本上可以满足要求全部,就不需要第一个56字节的数据了.把数据和在一起也方便呢,不是么?^_^.

那这些地方具体填写些什么东西呢?大致来说分为三个部分:

1.导入表,包括"URLDownloadToFile"这个函数的字符串和"URLMON.DLL"这个DLL的字符串.

2.文件的可执行机器码.

3.函数需要的数据.



首先是导入表,根据上一节说的那些,我们可以很容易的判断出这个"URLDownloadToFile"该填在"58 11 00 00"的位置.当然你可以改这个值,这个值只是我写的.总之你想吧这个导入表放在什么位置,这个"58 11 00 00"就要指向这个位置.于是我们在PE文件的00000158位置写入"31 00 URLDownloadToFile"字符串,前面两个16进制是序号是给转载器提供信息作为在DLL中导出地址的依据. <