vc编写自己的壳之一：对pe文件OEP的修改

最新推荐文章于 2022-03-02 14:20:58 发布

iiprogram

最新推荐文章于 2022-03-02 14:20:58 发布

阅读量1.2k

点赞数

分类专栏：病毒汇编和调试逆向技术加脱壳文章标签： header image dos cmd null file

病毒汇编和调试逆向技术加脱壳专栏收录该内容

506 篇文章 18 订阅

订阅专栏

调试了下修改pe文件的oep，然后在新的入口点什么都没做，只是jmp回到原始入口点，程序继续执行．测试通过．准备明天在自己入口点的地方添加一个MessageBox代码.

很多是网上朋友的代码，借用下不好意思，如有版权等问题请联系偶，偶会尽快处理，谢谢．

void CPeSecDlg::Go()
{
HANDLE hFile, hMapping;
void * basepointer = NULL;
if(INVALID_HANDLE_VALUE == (hFile = CreateFile("C://CenterServer.exe",
  GENERIC_READ | GENERIC_WRITE,
  FILE_SHARE_READ | FILE_SHARE_WRITE,
  0,
  OPEN_EXISTING,
  FILE_FLAG_SEQUENTIAL_SCAN,
  0)))
{
  AfxMessageBox("打开失败！！");
  return;
}

if(!(hMapping = CreateFileMapping(hFile, 0, PAGE_READONLY | SEC_COMMIT, 0, 0, 0)))
{
  AfxMessageBox("CreateFileMapping打开失败！！");
  CloseHandle(hFile);
  return;
}

if(!(basepointer = MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, 0)))
{
  AfxMessageBox("MapViewOfFile");
  CloseHandle(hMapping);
  CloseHandle(hFile);
  return;
}

IMAGE_DOS_HEADER * dos_head = (IMAGE_DOS_HEADER*)basepointer;
IMAGE_NT_HEADERS * header = (IMAGE_NT_HEADERS*)((char*)dos_head + dos_head->e_lfanew);
DWORD oldOEP = header->OptionalHeader.AddressOfEntryPoint;
IMAGE_SECTION_HEADER * sectionHeader = (IMAGE_SECTION_HEADER*)(((char*)header + sizeof(IMAGE_NT_HEADERS)));

//此段真实长度
DWORD dwVirtSize = sectionHeader->Misc.VirtualSize;
//此段物理偏移
DWORD dwPhysAddress = sectionHeader->PointerToRawData;
//此段物理长度
DWORD dwPhysSize = sectionHeader->SizeOfRawData;
//取得此段的可用空间
DWORD dwSpace = dwPhysSize - dwVirtSize;
//取得程序的装载地址
DWORD dwProgRAV = header->OptionalHeader.ImageBase;

//代码偏移一般为0
DWORD dwCodeOffset = header->OptionalHeader.BaseOfCode - dwPhysAddress;

//代码写入的物理偏移
DWORD dwEntryWrite = dwPhysAddress + dwVirtSize;
if(0 != (dwEntryWrite%16))
{
dwEntryWrite += (16 - (dwEntryWrite%16));
}

//计算新的程序入口地址
DWORD dwNewEntryAddress = dwEntryWrite + dwCodeOffset;

//将jmp oldOEP的代码写入新的入口地址
SetFilePointer(hFile, dwNewEntryAddress, NULL, FILE_BEGIN);
//jmp oldOEP的16进值码为0xE90002D820
DWORD iWrited = 0;
char cmd[4] = {0};
ChangeDwordToString(/*0x0002D820*/0xFFFE069B, cmd);
/* cmd[0] = (char)0x00;
cmd[1] = (char)0x02;
cmd[2] = (char)0xD8;
cmd[3] = (char)0x20;
WriteFile(hFile, cmd, 4, &iWrited, NULL);
*/ char d[1] = {0};
d[0] = (char)0xE9;
WriteFile(hFile, d, 1, &iWrited, NULL);
WriteFile(hFile, cmd, 4, &iWrited, NULL);

//设置新的入口地址
int nEntryPos = dos_head->e_lfanew + 40;
SetFilePointer(hFile, nEntryPos, NULL, FILE_BEGIN);
char pBuffer[4] = {0};
ChangeDwordToString(/*0x0002D820*/dwNewEntryAddress, pBuffer);
WriteFile(hFile, pBuffer, 4, &iWrited, NULL);

//OK
}

//转换DWORD为字符串，并转换成低低高高顺序
void CPeSecDlg::ChangeDwordToString(DWORD d, char *cBuffer)
{
unsigned char waddress[4] = {0};

cBuffer[3] = (char)(d>>24)&0xFF;
cBuffer[2] = (char)(d>>16)&0xFF;
cBuffer[1] = (char)(d>>8)&0xFF;
cBuffer[0] = (char)(d)&0xFF;
}