Pamqara写过一个PELibrary,但自己写的东西毕竟用起来比较顺手,所以自己建了一个简单的library,给写壳提供了一些特别的方便性.
时间关系,注释不是很详细,让代码来说话吧,欢迎报告bug和扩充库:)
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;>>>>>>>> Win32 PE Library >>>>>>>>>>>>>>>
;>>>>>>>> by cyclotron >>>>>>>>>>>>>>>
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.486
.model flat, stdcall
option casemap:none
include windows.inc
include user32.inc
include kernel32.inc
include comdlg32.inc
includelib user32.lib
includelib kernel32.lib
includelib comdlg32.lib
InitFileMap proto
CheckPEValidity proto
CloseFileMap proto
GetPeInfo proto :dword
RVA2Offset proto :dword
Offset2RVA proto :dword
GetImportsInfo proto :dword
GetCodeScnInfo proto :dword
ObfuscateOEP proto :dword
UpdateEntryPoint proto :dword
AlignFile proto :dword
AlignScn proto :dword
AddSection proto :dword,:dword,:dword
GetScnInfo proto :dword,:dword
GetExtraDataInfo proto :dword
MergeScns proto :dword,:dword,:dword
OpenFileDialog proto
CreateOutFile proto
AppendScnCode proto :dword,:dword,:dword,:dword
UpdatePackedScnHeader proto :dword,:dword,:dword
CheckPackingFlag proto :dword
SetPackingFlag proto :dword
UpdateImportRVA proto :dword
GetStrLen proto :dword
tEHash proto :dword,:dword,:dword
crc32 proto :dword,:dword
.data
hInFile dd 0
hOutFile dd 0
dwFileSize dd 0
lpBytesRead dd 0
lpPeHeader dd 0
lpFileHeader dd 0
szPeFileName db MAX_PATH dup(0)
szFilter db 'eXeFiles',0,'*.exe',0,'All Files',0,'*.*',0,0
szCurrentDir db '.',0
szTitle db 'Win32 PE Library - Proudly Presented by cyclotron',0
CurrentHashOffset dd 0
;STRUCTURES
PE_INFO struct
dwEntryPointRVA dd ?
dwImageBase dd ?
dwSectionAlignment dd ?
dwFileAlignment dd ?
dwSizeOfImage dd ?
dwCheckSum dd ?
dwNumberOfSections dd ?
PE_INFO ends
IMPORTS_INFO struct
dwImportDirRVA dd ?
dwImportDirSize dd ?
lpImportDir dd ?
dwIATDirRVA dd ?
dwIATDirSize dd ?
lpIATDir dd ?
IMPORTS_INFO ends
SCN_INFO struct
szName dq 0
dwVirtualSize dd ?
dwVirtualAddress dd ?
dwRawSize dd ?
dwRawAddress dd ?
dwCharacteristics dd ?
lpScn dd ?
SCN_INFO ends
EXTRADATA_INFO struct
dwRawAddress dd ?
dwSize dd ?
lpExtraData dd ?
EXTRADATA_INFO ends
.code
InitFileMap proc
invoke CreateFile,offset szPeFileName,/
GENERIC_READ,/
FILE_SHARE_READ,/
NULL,OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,/
NULL
.if eax == INVALID_HANDLE_VALUE
mov eax,FALSE
ret
.else
mov hInFile,eax
.endif
invoke GetFileSize,hInFile,NULL
mov dwFileSize,eax
invoke VirtualAlloc,NULL,eax,MEM_COMMIT,PAGE_READWRITE
mov lpFileHeader,eax
invoke ReadFile,hInFile,eax,dwFileSize,offset lpBytesRead,NULL
.if eax != 0
mov eax,TRUE
.else
mov eax,FALSE
.endif
ret
InitFileMap endp
CheckPEValidity proc uses esi
mov esi,lpFileHeader
.if word ptr [esi] == IMAGE_DOS_SIGNATURE
assume esi:ptr IMAGE_DOS_HEADER
add esi,[esi].e_lfanew
assume esi:nothing
.if word ptr [esi] == IMAGE_NT_SIGNATURE
mov lpPeHeader,esi
.else
mov eax,FALSE
ret
.endif
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret
CheckPEValidity endp
CloseFileMap proc
invoke VirtualFree,lpFileHeader,0,MEM_RELEASE
.if eax==0
mov eax,FALSE
ret
.endif
mov lpFileHeader,0
invoke CloseHandle,hInFile
mov hInFile,0
mov eax,TRUE
ret
CloseFileMap endp
GetPeInfo proc uses esi edi @lpPeInfo:dword
mov esi,lpPeHeader
assume esi:ptr IMAGE_NT_HEADERS
mov edi,@lpPeInfo
assume edi:ptr PE_INFO
push [esi].OptionalHeader.AddressOfEntryPoint
pop [edi].dwEntryPointRVA
push [esi].OptionalHeader.ImageBase
pop [edi].dwImageBase
push [esi].OptionalHeader.SectionAlignment
pop [edi].dwSectionAlignment
push [esi].OptionalHeader.FileAlignment
pop [edi].dwFileAlignment
push [esi].OptionalHeader.SizeOfImage
pop [edi].dwSizeOfImage
push [esi].OptionalHeader.CheckSum
pop [edi].dwCheckSum
mov ax,[esi].FileHeader.NumberOfSections
cwd
mov [edi].dwNumberOfSections,eax
assume esi:nothing
assume edi:nothing
ret
GetPeInfo endp
RVA2Offset proc uses ebx ecx edx edi esi @dwRVA:dword
mov esi,lpFileHeader
assume esi:ptr IMAGE_DOS_HEADER
add esi,[esi].e_lfanew
assume esi:ptr IMAGE_NT_HEADERS
mov edi,@dwRVA
mov edx,esi
add edx,sizeof IMAGE_NT_HEADERS
mov cx,[esi].FileHeader.NumberOfSections
movzx ecx,cx
assume edx:ptr IMAGE_SECTION_HEADER
.while ecx > 0
.if edi >= [edx].VirtualAddress
mov eax,[edx].VirtualAddress
add eax,[edx].SizeOfRawData
.if edi < eax
mov eax,[edx].VirtualAddress
sub edi,eax
mov eax,[edx].PointerToRawData
add eax,edi
ret
.endif
.endif
add edx,sizeof IMAGE_SECTION_HEADER
dec ecx
.endw
assume edx:nothing
assume esi:nothing
mov eax,FALSE
ret
RVA2Offset endp
Offset2RVA proc uses ebx ecx edx edi esi @dw
cyclotron's Win32 PE Library
最新推荐文章于 2021-12-30 10:53:26 发布
![](https://img-home.csdnimg.cn/images/20240711042549.png)