滴水三期逆向基础系列(三)-新建节，可添加代码

VOID AddNewSection(
	size_t sectionLength
){
	LPVOID pFileBuffer = NULL;
	LPVOID pTempFileBuffer = NULL;
	size_t fileSize = ReadPEFile(FilePath_In, &pFileBuffer);
	if(pFileBuffer == NULL){
		printf("文件 --> 文件缓冲区失败");
		return ;
	}

	PIMAGE_DOS_HEADER pDosHeader = NULL;
	PIMAGE_NT_HEADERS pNTHeader = NULL;
	PIMAGE_FILE_HEADER pFileHeader = NULL;
	PIMAGE_OPTIONAL_HEADER pOptionHeader = NULL;
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;

	pTempFileBuffer = malloc(fileSize + sectionLength);
	if(pTempFileBuffer == NULL){
		printf("临时文件缓冲区申请失败");
		free(pFileBuffer);
		return ;
	}
	memset(pTempFileBuffer, 0, fileSize + sectionLength);
	memcpy(pTempFileBuffer, pFileBuffer, fileSize);

	pDosHeader = (PIMAGE_DOS_HEADER)pTempFileBuffer;
	pNTHeader = (PIMAGE_NT_HEADERS)((BYTE *)pDosHeader + pDosHeader->e_lfanew);
	pFileHeader = (PIMAGE_FILE_HEADER)((BYTE *)pNTHeader + sizeof(DWORD));
	pOptionHeader = (PIMAGE_OPTIONAL_HEADER)((BYTE *)pFileHeader + IMAGE_SIZEOF_FILE_HEADER);

	pSectionHeader = (PIMAGE_SECTION_HEADER)((BYTE *)pOptionHeader + pFileHeader->SizeOfOptionalHeader);
	pFileHeader->NumberOfSections = pFileHeader->NumberOfSections + 1;
	pOptionHeader->SizeOfImage = pOptionHeader->SizeOfImage + sectionLength;
	pSectionHeader += pFileHeader->NumberOfSections - 1;

	DWORD SizeOfData = 0;
	DWORD maxSize = 0;

	strcpy((char *)pSectionHeader->Name, ".yangle");
	pSectionHeader->Misc.VirtualSize = sectionLength;
	maxSize = (pSectionHeader - 1)->Misc.VirtualSize > (pSectionHeader - 1)->SizeOfRawData?(pSectionHeader - 1)->Misc.VirtualSize:(pSectionHeader - 1)->SizeOfRawData;
	if(maxSize % pOptionHeader->SectionAlignment == 0){
		SizeOfData = maxSize / pOptionHeader->SectionAlignment * pOptionHeader->SectionAlignment;
	}else{
		SizeOfData = maxSize / pOptionHeader->SectionAlignment * pOptionHeader->SectionAlignment + pOptionHeader->SectionAlignment;
	}
	pSectionHeader->VirtualAddress = (pSectionHeader - 1)->VirtualAddress + SizeOfData;
	pSectionHeader->SizeOfRawData = sectionLength;
	pSectionHeader->PointerToRawData = (pSectionHeader - 1)->PointerToRawData + (pSectionHeader - 1)->SizeOfRawData;
	pSectionHeader->Characteristics = (pSectionHeader - 1)->Characteristics;

	MemoryToFile(pTempFileBuffer,fileSize + sectionLength,FilePath_Out);

}

脑海里一定要有PE文件结构图，写这才能的心应手。

一定要记得节对齐！