导入表注入

一 、流程

1、File-> FileBuffer
2、添加节
3、定位导入表
4、将导入表移动到新增的节里面
5、新增一个导入表
6、在导入表后面添加INT表和IAT表
7、INT和IAT表指向函数名
8、修正导入表
9、存盘

二、演示

1、File-> FileBuffer

DWORD	Size			=	0;		//用来接收数据大小
BOOL	isok			=	FALSE;		//用来接收写入磁盘是否成功
LPVOID	pFileBuffer		=	NULL;


PIMAGE_DOS_HEADER pDosHeader = NULL;//DOS头
PIMAGE_NT_HEADERS pNtHeader = NULL;//NT头
PIMAGE_FILE_HEADER pFileHeader = NULL;//标准PE头
PIMAGE_OPTIONAL_HEADER pOptionalHeader = NULL;//拓展PE头
PIMAGE_SECTION_HEADER pSectionHeader = NULL;//节表
PIMAGE_SECTION_HEADER pNewSec = NULL;//新节表结构
PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor = NULL; //导出表结构体

//File-> FileBuffer
Size = ReadPEFile(FILEPATH_IN,&pFileBuffer);	//调用函数读取文件数据
if(!pFileBuffer || !Size)
{
	printf("File-> FileBuffer失败");
	return;
}

2、添加节

pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew);
pFileHeader = (PIMAGE_FILE_HEADER)((DWORD)pNtHeader + 4);
pOptionalHeader = (PIMAGE_OPTIONAL_HEADER)((DWORD)pFileHeader + IMAGE_SIZEOF_FILE_HEADER);
pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionalHeader + pFileHeader->SizeOfOptionalHeader);

//判断是否有足够的空间添加节表
if((DWORD)pNtHeader - (DWORD)pDosHeader - 0x40 < sizeof(IMAGE_SECTION_HEADER))
{
printf("没有多余空间");
free(pFileBuffer);
return;
}

memcpy((void*)((DWORD)pDosHeader + 0x40),
pNtHeader,
(DWORD)(pSectionHeader + pFileHeader->NumberOfSections) - (DWORD)pNtHeader);

pDosHeader->e_lfanew = 0x40;

pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew);
pFileHeader = (PIMAGE_FILE_HEADER)((DWORD)pNtHeader + 4);
pOptionalHeader = (PIMAGE_OPTIONAL_HEADER)((DWORD)pFileHeader + IMAGE_SIZEOF_FILE_HEADER);
pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionalHeader + pFileHeader->SizeOfOptionalHeader);

//新增节表结构
pNewSec = (PIMAGE_SECTION_HEADER)(pSectionHeader + pFileHeader->NumberOfSections);

memset(pNewSec, 0, (DWORD)(pSectionHeader + pFileHeader->NumberOfSections) - (DWORD)pNtHeader);

//修改节表内容
memcpy(pNewSec->Name,".ttttt",8);//修改节表名

PIMAGE_SECTION_HEADER upSecHeader = (PIMAGE_SECTION_HEADER)(pSectionHeader + pFileHeader->NumberOfSections-1);

if(upSecHeader->Misc.VirtualSize > upSecHeader->SizeOfRawData)//修改节表VrituallAddress
{
        pNewSec->VirtualAddress = upSecHeader->VirtualAddress + upSecHeader->Misc.VirtualSize;
}else{
        pNewSec->VirtualAddress = upSecHeader->VirtualAddress + upSecHeader->SizeOfRawData;
}

pNewSec->SizeOfRawData = 0x1000;//新增的节区的大小
pNewSec->PointerToRawData = upSecHeader->PointerToRawData