【2021.01.14】合并节

#define IMAGE_SIZEOF_SHORT_NAME              8
 
typedef struct _IMAGE_SECTION_HEADER {
    BYTE    Name[IMAGE_SIZEOF_SHORT_NAME];
    union {
            DWORD   PhysicalAddress;
            DWORD   VirtualSize;
    } Misc;
    DWORD   VirtualAddress;
    DWORD   SizeOfRawData;
    DWORD   PointerToRawData;
    DWORD   PointerToRelocations;
    DWORD   PointerToLinenumbers;
    WORD    NumberOfRelocations;
    WORD    NumberOfLinenumbers;
    DWORD   Characteristics;
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

合并节

• 按照内存对齐展开
• 将第一个节的内存大小、文件大小改成一样
• Max = SizeOfRawData->VirtualSize?SizeOfRawData:VirtualSize
• SizeOfRawData = VirtualSize = 最后一个节的 VirtualAddress + Max - SizeOfHeaders内存对齐后的大小
• 将第一个节的属性改为包含所有节的属性
• 修改节的数量为1