内核重载

#include "stdio.h"
#include "windows.h"

#define	__Max(a,b)	a>b?a:b

void ReadPeFile()
{
	HANDLE					hFile;
	ULONG					uIndex;
	BOOL					bStatus;
	DWORD					dwRetSize;
	LARGE_INTEGER			FileOffset;
	IMAGE_DOS_HEADER		ImageDosHeader;
	IMAGE_NT_HEADERS		ImageNtHeader;
	IMAGE_SECTION_HEADER	*pImageSectionHeader;

	hFile = CreateFile(\
		L"C:\\EditPlus_E\\EditPlus 3\\EditPlus.exe",\
		FILE_ALL_ACCESS,\
		0,\
		NULL,\
		OPEN_ALWAYS,\
		FILE_ATTRIBUTE_NORMAL,\
		NULL);

	if (hFile==INVALID_HANDLE_VALUE)
	{
		return;
	}

	bStatus = ReadFile(\
		hFile,\
		&ImageDosHeader,\
		sizeof(IMAGE_DOS_HEADER),\
		&dwRetSize,\
		NULL);

	if (bStatus==FALSE)
	{
		printf("read image_dos_header failed:%d",GetLastError());
		CloseHandle(hFile);
		return;
	}

	printf("ImageDosHeader.e_magic:%s\nImageDosHeader.e_lfanew:%X\n",\
		&ImageDosHeader.e_magic,
		ImageDosHeader.e_lfanew);

	FileOffset.QuadPart = ImageDosHeader.e_lfanew;
	bStatus = SetFilePointerEx(hFile,FileOffset,NULL,FILE_BEGIN);
	if (bStatus==FALSE)
	{
		printf("SetFilePointerEx failed:%d",GetLastError());
		CloseHandle(hFile);
		return;
	}

	bStatus = ReadFile(\
		hFile,\
		&ImageNtHeader,\
		sizeof(IMAGE_NT_HEADERS),\
		&dwRetSize,\
		NULL);
	if (bStatus==FALSE)
	{
		printf("read image_nt_header failed:%d",GetLastError());
		CloseHandle(hFile);
		return;
	}

	printf("ImageNtHeader.Signature:%s\nNumberOfSections:%d\n",\
		&ImageNtHeader.Signature,\
		ImageNtHeader.FileHeader.NumberOfSections);

	FileOffset.QuadPart += sizeof(IMAGE_NT_HEADERS);
	bStatus = SetFilePointerEx(hFile,FileOffset,NULL,FILE_BEGIN);
	if (bStatus==FALSE)
	{
		printf("SetFilePointerEx failed:%d",GetLastError());
		CloseHandle(hFile);
		return;
	}

	pImageSectionHeader = malloc(sizeof(IMAGE_SECTION_HEADER)*ImageNtHeader.FileHeader.NumberOfSections);
	if (pImageSectionHeader==0)
	{
		CloseHandle(hFile);
		return;
	}

	bStatus = ReadFile(\
		hFile,\
		pImageSectionHeader,
		sizeof(IMAGE_SECTION_HEADER)*ImageNtHeader.FileHeader.NumberOfSections,\
		&dwRetSize,\
		NULL);
	if (bStatus==FALSE)
	{
		printf("read image_section_header failed:%d",GetLastError());
		free(pImageSectionHeader);
		CloseHandle(hFile);
		return;
	}

	for (uIndex = 0;uIndex<ImageNtHeader.FileHeader.NumberOfSections;uIndex++)
	{
		printf("pImageSectionHeader[%d]:%s\n",uIndex,&pImageSectionHeader[uIndex].Name);
	}

	free(pImageSectionHeader);
	CloseHandle(hFile);
}

void ReadFileToMemory()
{
	HANDLE					hFile;
	ULONG					uIndex;
	BOOL					bStatus;
	DWORD					dwRetSize;
	DWORD					VirtualSizeOfImage;
	PVOID					lpVirtualPointer;
	DWORD					SecVirtualAddress,SizeOfSection;
	DWORD					PointerToRawData;
	LARGE_INTEGER			FileOffset;
	IMAGE_DOS_HEADER		ImageDosHeader;
	IMAGE_NT_HEADERS		ImageNtHeader;
	IMAGE_SECTION_HEADER	*pImageSectionHeader;

	hFile = CreateFile(\
		L"C:\\EditPlus_E\\EditPlus 3\\EditPlus.exe",\
		FILE_ALL_ACCESS,\
		0,\
		NULL,\
		OPEN_ALWAYS,\
		FILE_ATTRIBUTE_NORMAL,\
		NULL);

	if (hFile==INVALID_HANDLE_VALUE)
	{
		return;
	}

	bStatus = ReadFile(\
		hFile,\
		&ImageDosHeader,\
		sizeof(IMAGE_DOS_HEADER),\
		&dwRetSize,\
		NULL);

	if (bStatus==FALSE)
	{
		printf("read image_dos_header failed:%d",GetLastError());
		CloseHandle(hFile);
		return;
	}

	printf("ImageDosHeader.e_magic:%s\nImageDosHeader.e_lfanew:%X\n",\
		&ImageDosHeader.e_magic,
		ImageDosHeader.e_lfanew);

	FileOffset.QuadPart = ImageDosHeader.e_lfanew;
	bStatus = SetFilePointerEx(hFile,FileOffset,NULL,FILE_BEGIN);
	if (bStatus==FALSE)
	{
		printf("SetFilePointerEx failed:%d",GetLastError());
		CloseHandle(hFile);
		return;
	}

	bStatus = ReadFile(\
		hFile,\
		&ImageNtHeader,\
		sizeof(IMAGE_NT_HEADERS),\
		&dwRetSize,\
		NULL);
	if (bStatus==FALSE)
	{
		printf("read image_nt_header failed:%d",GetLastError());
		CloseHandle(hFile);
		return;
	}

	printf("ImageNtHeader.Signature:%s\nNumberOfSections:%d\n",\
		&ImageNtHeader.Signature,\
		ImageNtHeader.FileHeader.NumberOfSections);

	FileOffset.QuadPart += sizeof(IMAGE_NT_HEADERS);
	bStatus = SetFilePointerEx(hFile,FileOffset,NULL,FILE_BEGIN);
	if (bStatus==FALSE)
	{
		printf("SetFilePointerEx failed:%d",GetLastError());
		CloseHandle(hFile);
		return;
	}

	pImageSectionHeader = malloc(sizeof(IMAGE_SECTION_HEADER)*ImageNtHeader.FileHeader.NumberOfSections);
	if (pImageSectionHeader==0)
	{
		CloseHandle(hFile);
		return;
	}

	bStatus = ReadFile(\
		hFile,\
		pImageSectionHeader,
		sizeof(IMAGE_SECTION_HEADER)*ImageNtHeader.FileHeader.NumberOfSections,\
		&dwRetSize,\
		NULL);
	if (bStatus==FALSE)
	{
		printf("read image_section_header failed:%d",GetLastError());
		free(pImageSectionHeader);
		CloseHandle(hFile);
		return;
	}

	for (uIndex = 0;uIndex<ImageNtHeader.FileHeader.NumberOfSections;uIndex++)
	{
		printf("pImageSectionHeader[%d]:%s\n",uIndex,&pImageSectionHeader[uIndex].Name);
	}

	VirtualSizeOfImage = ImageNtHeader.OptionalHeader.SizeOfImage;

	lpVirtualPointer = malloc(VirtualSizeOfImage);
	if (lpVirtualPointer==0)
	{
		free(pImageSectionHeader);
		CloseHandle(hFile);
		return;
	}
	memset(lpVirtualPointer,0,VirtualSizeOfImage);

	memcpy(lpVirtualPointer,\
		&ImageDosHeader,\
		sizeof(IMAGE_DOS_HEADER));

	memcpy((PVOID)((long)lpVirtualPointer+ImageDosHeader.e_lfanew),\
		&ImageNtHeader,sizeof(IMAGE_NT_HEADERS));

	memcpy((PVOID)((ULONG)lpVirtualPointer+ImageDosHeader.e_lfanew+sizeof(IMAGE_NT_HEADERS)),\
		pImageSectionHeader,\
		sizeof(IMAGE_SECTION_HEADER)*ImageNtHeader.FileHeader.NumberOfSections);

	for (uIndex = 0;uIndex<ImageNtHeader.FileHeader.NumberOfSections;uIndex++)
	{
		SecVirtualAddress = pImageSectionHeader[uIndex].VirtualAddress;
		SizeOfSection = __Max(pImageSectionHeader[uIndex].SizeOfRawData,\
			pImageSectionHeader[uIndex].Misc.VirtualSize);

		PointerToRawData = pImageSectionHeader[uIndex].PointerToRawData;

		FileOffset.QuadPart = PointerToRawData;
		bStatus = SetFilePointerEx(hFile,FileOffset,NULL,FILE_BEGIN);
		if (bStatus==FALSE)
		{
			free(pImageSectionHeader);
			free(lpVirtualPointer);
			CloseHandle(hFile);
			return;
		}

		bStatus = ReadFile(\
			hFile,\
			(PVOID)((DWORD)lpVirtualPointer+SecVirtualAddress),\
			SizeOfSection,
			&dwRetSize,\
			NULL);
		if (bStatus==FALSE)
		{
			free(pImageSectionHeader);
			free(lpVirtualPointer);
			CloseHandle(hFile);
			return;
		}
	}

	printf("lpVirtualPointer:%X",lpVirtualPointer);

	getchar();
	getchar();

	free(pImageSectionHeader);
	free(lpVirtualPointer);
	CloseHandle(hFile);
}

void main(int argc, char **argv)
{
	ReadFileToMemory();
}