导入表注入

与其他人的导入表注入没什么区别，但是多加了一个判断是否为序号寻找，还是名字寻找

//导入表注入
VOID InjectByImportTable(PVOID fileName,PVOID dllName,PVOID functionName) {
	//增加节
	IncreaseSection(fileName);
	PVOID pFileBuffer = FileToFileBuffer(fileName);
	//定位导入表
	PIMAGE_DOS_HEADER pDosHeader = pFileBuffer;
	PIMAGE_NT_HEADERS pNTHeader = (DWORD)pDosHeader + pDosHeader->e_lfanew;
	if (pNTHeader->Signature != IMAGE_NT_SIGNATURE) {
		printf("File is not PE\n");
		free(pFileBuffer);
		return FALSE;
	}
	PIMAGE_FILE_HEADER pFileHeader = &pNTHeader->FileHeader;
	PIMAGE_OPTIONAL_HEADER pOptHeader = (DWORD)pFileHeader + sizeof(IMAGE_FILE_HEADER);
	PIMAGE_SECTION_HEADER pSecHeader = (DWORD)pOptHeader + pFileHeader->SizeOfOptionalHeader;
	PIMAGE_SECTION_HEADER pLastSecHeader = pSecHeader + pFileHeader->NumberOfSections - 1;
	PIMAGE_IMPORT_DESCRIPTOR pImportTables = VAToFOA(
		pOptHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress, pFileBuffer);
	PIMAGE_IMPORT_DESCRIPTOR pImportTablesTemp = pImportTables;
	//移动导入表，改写目录表
	PBYTE pWritePostion = pLastSecHeader->PointerToRawData + (DWORD)pFileBuffer;
	DWORD sizeOfImportTable = sizeof(IMAGE_IMPORT_DESCRIPTOR);
	while ((pImportTablesTemp + 1)->FirstThunk) {
		pImportTablesTemp++;
		sizeOfImportTable += sizeof(IMAGE_IMPORT_DESCRIPTOR);
	}
	memcpy(pWritePostion, pImportTables, sizeOfImportTable);
	memset(pImportTables, 0, sizeOfImportTable);
	pOptHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress =
		FOAToVA(pWritePostion - (DWORD)pFileBuffer, pFileBuffer);
	pWritePostion += sizeOfImportTable;
	//构造新一张导入表，不填入数据只是淡出的记录写入位置，留2个结构大小的位置

	PIMAGE_IMPORT_DESCRIPTOR pNewImportTable = pWritePostion;
	pWritePostion += (2 * sizeof(IMAGE_IMPORT_DESCRIPTOR));
	/*构造OriginalFirstThunk表和FirstThunk表，还有ImportByName表，最后再写入字符串DllName
	，依次填入新表里*/
	PDWORD pOriginalFirstThunk = pWritePostion;
	pWritePostion += 8;
	PDWORD pFirstThunk = pWritePostion;
	pWritePostion += 8;
	//加了一个判断是字符串还是序号
	if (IsStringForGetProcAddress(functionName)) {
		PIMAGE_IMPORT_BY_NAME pImportByName = pWritePostion;
		strcpy(pImportByName->Name, functionName);
		*pOriginalFirstThunk = FOAToVA((DWORD)pImportByName - (DWORD)pFileBuffer, pFileBuffer);
		*pFirstThunk = FOAToVA((DWORD)pImportByName - (DWORD)pFileBuffer, pFileBuffer);
		pWritePostion += (2 + strlen(pImportByName->Name) + 1);
	}
	else {
		*pOriginalFirstThunk = (DWORD)functionName | 0x80000000;
		*pFirstThunk = (DWORD)functionName | 0x80000000;
	}
	strcpy(pWritePostion, dllName);
	pNewImportTable->Name = FOAToVA(pWritePostion - (DWORD)pFileBuffer, pFileBuffer);
	pNewImportTable->OriginalFirstThunk = FOAToVA((DWORD)pOriginalFirstThunk- (DWORD)pFileBuffer, pFileBuffer);
	pNewImportTable->FirstThunk = FOAToVA((DWORD)pFirstThunk - (DWORD)pFileBuffer, pFileBuffer);
	//存盘
	FileBufferToFile(fileName, pFileBuffer, pLastSecHeader->PointerToRawData + pLastSecHeader->SizeOfRawData);
}

感觉实现一个判断是否为字符串太复杂了，所以因地制宜不如直接判断这个数字是否在合理的范围内，这个范围不可能为字符串指针，正常情况也不能有比这个更大的序号

//判断是否为字符串，给判断是否为序号GetProcAddress使用
BOOL IsStringForGetProcAddress(DWORD buffer) {
	if (buffer >= 0 && buffer < 0xffff ) {
		return FALSE;
	}
	return TRUE;
}