在这里插入代码片
```BOOL MergeSection(char*lpszFileName)
{
//读取文件到内存
//拉伸为运行状态
//修改节表信息
//修改numberofsection为1
//restore为文件状态
//保存文件
LPVOID pImage=NULL;
DWORD dwFileSize= ReadFileToImage(lpszFileName,&pImage);
LPVOID pNewBuffer = NULL;
ImageBufferToNewBuffer(pImage,&pNewBuffer);
LPVOID pSection = NULL;
GetPESectionTable(pNewBuffer, &pSection);
PVOID pFileHeader = NULL;
GetPEFileHeader(pNewBuffer, &pFileHeader);
WORD wNumberOfSections = ((PIMAGE_FILE_HEADER)pFileHeader)->NumberOfSections;
LPVOID FinallySection = NULL;
GetPESectionTable(pNewBuffer, &FinallySection,wNumberOfSections);
PVOID pOptionHeader = NULL;
GetPEOptionHeader(pNewBuffer, &pOptionHeader);
//VirtualSize在内存中的大小修改为 sizeofImage-VirtualAddress
((PIMAGE_SECTION_HEADER)pSection)->Misc.VirtualSize = ((PIMAGE_OPTIONAL_HEADER32)pOptionHeader)->SizeOfImage -
((PIMAGE_SECTION_HEADER)pSection)->VirtualAddress;
//SizeOfRawData=最后一个节表的偏移+大小-第一个节在文件的偏移
((PIMAGE_SECTION_HEADER)pSection)->SizeOfRawData = ((PIMAGE_OPTIONAL_HEADER32)pOptionHeader)->SizeOfImage -
((PIMAGE_SECTION_HEADER)pSection)->VirtualAddress;
//从第一个节开始数据为0
DWORD dwIndex = 1;
while (dwIndex<=wNumberOfSections)
{
//属性修改为每个节表的属性组合 **********这里比较重要**********
((PIMAGE_SECTION_HEADER)pSection)->Characteristics |= ((PIMAGE_SECTION_HEADER)pSection + dwIndex)->Characteristics;
ZeroMemory((char*)pSection+sizeof(IMAGE_SECTION_HEADER)*dwIndex, sizeof(IMAGE_SECTION_HEADER));
dwIndex++;
}
//修改numberofsection为1
((PIMAGE_FILE_HEADER)pFileHeader)->NumberOfSections = 1;
//restore为文件状态
PVOID pNewImage = NULL;
NewBufferToImageBuffer(pNewBuffer, &pNewImage);
ImageBufferToFile(pNewImage, "c:/MergeSection.exe");
//保存文件
return TRUE;
}
合并节
最新推荐文章于 2023-01-31 00:48:26 发布