PE文件扩大节的代码实现

一、扩大节（一般只适合扩大最后一个节）

//1、拉伸到内存
//2、重新分配一块新的内存：SizeOfImage + Ex
//3、将最后一个节的SizeOfRawData和VirtualSize改成N，
//    N=SizeOfRawData=VirtualSize=(SizeOfRawData或者VirtualSize 内存对齐后的值) + Ex
//4、修改sizeofimage大小，sizeofimage = sizeofimage + Ex

二、代码实现

PVOID EnlargeLastSection(PVOID pImageBuffer,DWORD NewSpace)
{
	//头部
	PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)pImageBuffer;
	PIMAGE_NT_HEADERS pNT = (PIMAGE_NT_HEADERS)((DWORD)pImageBuffer + pDos->e_lfanew);
	PIMAGE_FILE_HEADER pFileHeader = (PIMAGE_FILE_HEADER)((DWORD)pNT + 4);
	PIMAGE_OPTIONAL_HEADER pOptional = (PIMAGE_OPTIONAL_HEADER)((DWORD)pFileHeader + 0x14);
	
	//新开辟一块空间，大小为：sizeOfImage+NewSpace
	PVOID pNewImageBuffer = malloc(pOptional->SizeOfImage + NewSpace);
	memset(pNewImageBuffer, 0, pOptional->SizeOfImage + NewSpace);//新空间全部置零
	
	//拷贝前先修改pImageBuffer中的节的属性
	PIMAGE_SECTION_HEADER pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pFileHeader + 20 + pFileHeader->SizeOfOptionalHeader);
	pSectionHeader = pSectionHeader + pFileHeader->NumberOfSections - 1;//指向最后一个节表
	pSectionHeader->SizeOfRawData += NewSpace;
	pSectionHeader->Misc.VirtualSize = pSectionHeader->SizeOfRawData;
	pOptional->SizeOfImage += NewSpace;
	
	//修改属性后统一复制到pNewImageBuffer空间
	memcpy(pNewImageBuffer, pImageBuffer, pOptional->SizeOfImage);
	return pNewImageBuffer;
}