【HexWS】自己写一个PE文件 _蹭课学习成果

环境：Hex Workshop

先解决DOS头。

在弹出的对话框中选择十六进制，字节数量填40。点确定，40h就是DOS头的大小。

光标插到第一字节前，输入4D5A，对应ASCII码MZ，这是DOS可执行文件标志。如图，最后四个字节用来指示PE文件头开始的地址，我们的PE头将从00000040位置开始，所以把最后四个字节改为40 00 00 00（低低高高对应关系）。

DOS头完成了，是不是很简单啊！

―――――――――――――――――――――――――――――――――――

下面就是PE头，不过它比较复杂，在讲PE头之前我们先看几个重要的概念：文件偏移地址和相对虚似地址，上图黄色框中所示的就是文件偏移地址。即某个数据位置相对于文件头的偏移量。

文件执行过程中会把文件映射到内存中，在内存中文件头被映射到某一位置。其它字节的位置相对于头部映射的位置被称为相对虚似地址（RVA）。

文件从磁盘到内存映射过程中发生了一些变化。也就是怎样“对齐”的概念。

比如，一本书如果用32K的纸来印刷的话，假设一页32K的纸能容纳100个字，假设第一章有113个字，那么需要一页多一点的纸张（但下一章必须从新的一页开始），多出的地方就是空白（相当于文件中用0填充），所以第一章会占两页32K的纸。

假如现在用8K的纸来印刷的话，假设一页8K的纸能容纳400个字，那么第一章只用一页8K纸可以了。（因为第二章将从新一页开始），没字的部分就是空白（相当于文件中用0填充）。

在文件中“1页纸”一般200字节，在内存中一般1000字节。

 

―――――――――――――――――――――――――――――――――――

让我们继续吧！
PE头我们分成二块来讲。
第一部分：在空白的地方如前面的方法，插入18H个字节的0。需要修改的字节如图所示：

①处4个字节PE文件头的标志对应ASCII：PE\0\0；②处2个字节说明运行平台，014c表示intel处理器；③区块个数，相当于一本书多少章；④PE头第二部分的大小（可选头文件大小）⑤文件属性，普通exe文件一般是010f。
第二部分：插入E0h个字节。需要修改的字节如图所示：

①标志字，普通可执行映像一般是010B。②程序入口RVA，对应.text块的RVA，一般是1000。③文件装入内存的起始地址，一般是00400000。④内存对齐，1000，很重要。⑤磁盘对齐，是200，很重要。⑥要求最低子系统版本的主版本号，一设为0004对应win32子系统。⑦文件装入内存后的总大小，内存对齐是1000。DOS头＋PE头＋块表占1000字节；.text、.rdata、.data块分别占1000字节。所以这儿填4000。⑧DOS头＋PE头＋块表在磁盘中所占大小，磁盘对齐是200，这儿填00 02 00 00⑨这个可执行文件所期待的子系统，02为图形接口子系统。⑩ 对应最下面红框中数据的个数（8字节一组），PE文件基本都是10h。
―――――――――――――――――――――――――――――――
下面是块表
块表是对块的位置、大小以及一些属性的说明。
每个块表一共占28h个字节，一共3个块，新插入78h.。

我们以.text块表为例，①处共8个字节是块名，以“.”开头，后面填充0。 ②区块的实际大小，这儿是26h（请改成27），后面我们会知道他是怎么得出的。 ③.text块的RAV是1000，对应前面讲的程序入口地址。(后面的.rdata区块是2000，.data区块是3000) ④ 在磁盘文件上大小，200h(后面的.rdata和.data区块都是200) ⑤在磁盘文件上偏移，200(后面的.rdata区块是400，.data区块是600) ⑥块属性，具体请有兴趣的参考相关资料。

 

前言与目录结束了，还有最后一件事，DOS头＋PE头＋块表在磁盘中所占大小是以200字节对齐的，而现在还没到200字节，所以后面我们还要填50h字节的0。

 

下面是三个区块，首先是200字节的.text区。填充200字节的0

再填充200字节的0，作为.rdata。

再填充200字节的0，作为.data。

 

.data块主要用来存放数据，我们一共有二个字符串要存储。就是MessageBox的标题和上面显示的文字。

记住它们首地址偏移分别是00403000和00403017一会有用。（这些都是RVA，前面讲PE头时，我们设文件装入内存的起始地址是00400000，.data块的RVA是3000，下面都会算了吧^-^）


因为我们要显示一个消息框，所以要从外部导入user32.dll库中的MessageBox函数，程序退出要导入kernel32.dll库中的ExitProcess函数。怎么导入呢，这就和输入表有关啦。前面讲PE头第二部分有个标A的地方没讲，还有印像吗？那8个字节的数据就和输入表有关，前4个字节是输入表地址，后面是大小。
每导入一个DLL，我们就需要一个导入表。这个程序我们从2个DLL中导入函数，所以要2个输入表。那第一个输入表是不是从.rdata块首地址开始呢？不是这样的，这里有个规律，我们要导入多少个函数，那么就要空出8乘以导入函数的个数，这儿就空出16个字节，PE头中我们定义输入表的RAV是00 00 20 10对应。
如图每个输入表占14h个字节，最后以一个空表作为结束标志。

我们以输入表1为例来分析下输入表，输入表前4个字节所表示的地址指向一组指针，这些指针指向我们引用的所有引用的函数的名称。这些指针位于输入表空表之后，偏移为0000044c的位置，这个是磁盘偏移，转化为RAV为0000204c。从044c位置空出4个字节写指针（上面所知，该程序一个DLL对应一个函数），空出4个字节置0，作为结束的标志。输入表2和输入表1一样，也会占用8个字节。从044c开始再空出10h的字节，这就到了045c了。从这儿开始输入我们要调用的函数名和对应该的DLL名称，函数名前空出两个字节。结果如图所示！！字符串写好后，就可以把044c处的指针填上了！
输入表1的②四个字节对应该输入表DLL名称的RAV，如图，在磁盘上偏移是046A 这里是user32.dll，将这儿046A转化为RAV为206A，所以这儿填6A 20 00 00。③处三个字节同①一样，指向一组指针，这些指针指向我们引用的所有引用的函数的名称。这些指针就放在我们前面刚空出的10h个字节。


―――――――――――――――――――――――――――――――
现在解决.text区块了
代码如下：
压参数：
Push 0
Push 00403000
Push 00403013
Push 0
Call dword ptr ds:[402008]
Push 0
Call dword ptr ds:[402000]
jmp dword ptr [402008]
jmp dword ptr [402000]

附上HEX程序码

00000000 4D 5A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 MZ..............
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000030 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 ............@...
00000040 50 45 00 00 4C 01 03 00 00 00 00 00 00 00 00 00 PE..L...........
00000050 00 00 00 00 E0 00 0F 01 0B 01 00 00 00 00 00 00 ................
00000060 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 ................
00000070 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 ......@.........
00000080 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ................
00000090 00 40 00 00 00 02 00 00 00 00 00 00 02 00 00 00 .@..............
000000A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000B0 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
000000C0 10 20 00 00 3C 00 00 00 00 00 00 00 00 00 00 00 . ..<...........
000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000130 00 00 00 00 00 00 00 00 2E 74 65 78 74 00 00 00 .........text...
00000140 26 00 00 00 00 10 00 00 00 02 00 00 00 02 00 00 &...............
00000150 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
00000160 2E 72 64 61 74 61 00 00 92 00 00 00 00 20 00 00 .rdata....... ..
00000170 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 ................
00000180 00 00 00 00 40 00 00 40 2E 64 61 74 61 00 00 00 ....@..@.data...
00000190 3E 00 00 00 00 30 00 00 00 02 00 00 00 06 00 00 >....0..........
000001A0 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 ............@...
000001B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000001C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000200 6A 00 68 00 30 40 00 68 11 30 40 00 6A 00 FF 15 j.h.0@.h.0@.j...
00000210 08 20 40 00 6A 00 FF 15 00 20 40 00 FF 25 08 20 . @.j.... @..%. 
00000220 40 00 FF 25 00 20 40 00 00 00 00 00 00 00 00 00 @..%. @.........
00000230 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000290 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000002A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000002B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000002C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000002D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000002E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000002F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000300 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000330 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000350 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000360 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000370 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000390 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000400 5C 20 00 00 00 00 00 00 78 20 00 00 00 00 00 00 \ ......x ......
00000410 4C 20 00 00 00 00 00 00 00 00 00 00 6A 20 00 00 L ..........j ..
00000420 00 20 00 00 54 20 00 00 00 00 00 00 00 00 00 00 . ..T ..........
00000430 86 20 00 00 08 20 00 00 00 00 00 00 00 00 00 00 . ... ..........
00000440 00 00 00 00 00 00 00 00 00 00 00 00 5C 20 00 00 ............\ ..
00000450 00 00 00 00 78 20 00 00 00 00 00 00 80 00 45 78 ....x ........Ex
00000460 69 74 50 72 6F 63 65 73 73 00 6B 65 72 6E 65 6C itProcess.kernel
00000470 33 32 2E 64 6C 6C 00 00 9D 01 4D 65 73 73 61 67 32.dll....Messag
00000480 65 42 6F 78 41 00 75 73 65 72 33 32 2E 64 6C 6C eBoxA.user32.dll
00000490 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000004A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000004B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000004C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000004D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000004E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000004F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000500 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000510 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000520 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000540 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000550 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000560 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000570 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000580 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000590 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000005A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000005B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000005C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000005D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000005E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000005F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000600 49 63 7A 65 6C 69 6F 6E 20 54 75 74 6F 72 69 61 Iczelion Tutoria
00000610 6C 20 4E 6F 2E 32 00 57 69 6E 33 32 20 41 73 73 l No.2.Win32 Ass
00000620 65 6D 62 6C 79 20 69 73 20 47 72 65 61 74 21 00 embly is Great!.
00000630 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000640 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000650 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000670 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000680 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000690 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000006A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000006B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000006C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000006D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000006E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000006F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000700 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000710 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000720 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000730 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000740 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000750 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000760 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000770 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000780 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000790 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000007F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................