为PE区段的加区段,修改PE头的映像大小= =
代码如下:
BOOL LPESection::AddSection(char *pSectionName, DWORD &dwSectionSize,DWORD dwSectionStact)
{
LPVOID lPointer=NULL;
PBYTE pData=NULL;
DWORD newSectionAddr=0;
if (!IsPEFile())
{
return FALSE;
}
PIMAGE_NT_HEADERS pNTHdr=GetNtHeader();
//是否有足够空间容纳节头
if ((pNTHdr->FileHeader.NumberOfSections+1)*sizeof(IMAGE_SECTION_HEADER)>pNTHdr->OptionalHeader.SizeOfHeaders)
{
return FALSE;
}
//对齐数据
DWORD uCodeDelta=ZALIGN(dwSectionSize,pNTHdr->OptionalHeader.SectionAlignment);
DWORD uFileDelta=ZALIGN(dwSectionSize,pNTHdr->OptionalHeader.FileAlignment);
PIMAGE_SECTION_HEADER pNewSec=(PIMAGE_SECTION_HEADER)(pNTHdr+1)+pNTHdr->FileHeader.NumberOfSections;
PIMAGE_SECTION_HEADER pLaseSec=pNewSec-1;
//----------为将要创建的节赋值----------
strcpy((char*)pNewSec->Name,pSectionName);
pNewSec->VirtualAddress=pLaseSec->VirtualAddress+ZALIGN(pLaseSec->Misc.VirtualSize,pNTHdr->OptionalHeader.SectionAlignment);
newSectionAddr=pNewSec->PointerToRawData=pLaseSec->PointerToRawData+pLaseSec->SizeOfRawData;
pNewSec->Misc.VirtualSize=dwSectionSize;
pNewSec->SizeOfRawData=uFileDelta;
pNewSec->Characteristics=dwSectionStact;
//-------PE头的一些设置-----------------
pNTHdr->FileHeader.NumberOfSections++;
pNTHdr->OptionalHeader.SizeOfCode+=uFileDelta;
pNTHdr->OptionalHeader.SizeOfImage+=uCodeDelta;
pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size=0;
pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress=0;
dwSectionSize=uFileDelta;
//改变自身数据
DWORD dwOldSize=pstMapFile->dwFileSize;
pstMapFile->dwFileSize+=dwSectionSize;
UnmapViewOfFile(pstMapFile->hMapping);
CloseHandle(pstMapFile->hMapping);
pstMapFile->hMapping=CreateFileMapping(pstMapFile->hFile,NULL,PAGE_READWRITE,0,pstMapFile->dwFileSize,NULL);
pstMapFile->ImageBase=MapViewOfFile(pstMapFile->hMapping,FILE_MAP_ALL_ACCESS,0,0,pstMapFile->dwFileSize);
return TRUE;
}
pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size=0;
pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress=0;
上面这两行是平常在其他加区段的代码中不常见的,比如zapline的添加区段代码。如果没有上面这两句,那么对一些有bound iat的程序加壳后不能运行。原因
是IMAGE_BOUND_IMPORT_DESCTIPTOR结构中的OffsetModuleName变量存放的是与第一个IBID结构之间的偏移(不是RVA)。当你加了个新区段后,这个偏
移改变了,所以加壳就失败了~~