PE结构-扩大节区（附实例代码）

1、拉伸到内存

2、分配一块新的空间：SizeOfImage + Ex

3、将最后一个节的SizeOfRawData和VirtualSize改成N
SizeOfRawData = VirtualSize = N
N = (SizeOfRawData或者VirtualSize 内存对齐后的值) + Ex

4、修改SizeOfImage大小
SizeOfImage = SizeOfImage + Ex

BOOL EnlargedNodalRegion(IN LPVOID pImageBuffer, OUT LPVOID* pNewBuffer, size_t EnlargeSize)
{
	//DOC头
	PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pImageBuffer;
	//NT头
	PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew);
	//标准PE头
	PIMAGE_FILE_HEADER pPEHeader = (PIMAGE_FILE_HEADER)(((DWORD)pNTHeader) + 4);
	//可选PE头
	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + IMAGE_SIZEOF_FILE_HEADER);
	if (*((PWORD)pImageBuffer) != IMAGE_DOS_SIGNATURE)
	{
		printf("MZ文件标志头不存在！");
		free(pImageBuffer);
		return false;
	}
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;
	//申请新的空间
	pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader + pPEHeader->SizeOfOptionalHeader);
	for (int i = 1; i < pPEHeader->NumberOfSections; i++)
		pSectionHeader++;
	pSectionHeader->SizeOfRawData = pSectionHeader->Misc.VirtualSize = Align((pSectionHeader->SizeOfRawData += EnlargeSize) > (pSectionHeader->Misc.VirtualSize += EnlargeSize) ?
		pSectionHeader->SizeOfRawData: pSectionHeader->Misc.VirtualSize, pOptionHeader->SectionAlignment);
	pOptionHeader->SizeOfImage += EnlargeSize;
	*pNewBuffer = (PDWORD)malloc(pOptionHeader->SizeOfImage);
	if (!*pNewBuffer)
	{
		printf("%s", "申请新扩大节后的空间失败！");
		free(*pNewBuffer);
		return false;
	}
	memset(*pNewBuffer, 0, pOptionHeader->SizeOfImage);
	memcpy(*pNewBuffer, pImageBuffer, pOptionHeader->SizeOfImage);
	return true;
}

Github地址：https://github.com/vShellCode/Analysis-of-PE-structure