滴水PE部分作业

pe分析

#include<iostream>
#include<Windows.h>
using namespace std;
int len(FILE* pfile)
{
	fseek(pfile, 0, SEEK_END);
	int result = ftell(pfile);
	rewind(pfile);
	return result;
}
int main()
{
	FILE* pfile = NULL;
	pfile = fopen("C:\\Users\\52511\\Desktop\\1.exe", "rb");
	int fileLength = len(pfile);
	cout <<"文件大小：" << fileLength << " Bytes" << endl;
	char* buffer = (char*)malloc(sizeof(char)*fileLength);
	memset(buffer, 0, sizeof(char) * fileLength);
	fread(buffer, 1, fileLength, pfile);
	PIMAGE_DOS_HEADER readDosHeader;
	readDosHeader = (PIMAGE_DOS_HEADER)buffer;
	printf("===========DOS头============\n");
	printf("MZ标志位：%x\n", readDosHeader->e_magic);
	printf("PE头偏移：%x\n", readDosHeader->e_lfanew);


	printf("===========NT头============\n");
	PIMAGE_NT_HEADERS readNTheader;
	readNTheader = (PIMAGE_NT_HEADERS)(buffer + readDosHeader->e_lfanew);
	printf("PE标志位：%x\n", readNTheader->Signature);
	printf("运行平台：%x\n", readNTheader->FileHeader.Machine);
	printf("可选头大小：%x\n", readNTheader->FileHeader.SizeOfOptionalHeader);
	printf("ImageBase：%x\n", readNTheader->OptionalHeader.ImageBase);



	printf("===========节表============\n");
	PIMAGE_SECTION_HEADER readSectionHeader = (PIMAGE_SECTION_HEADER)(buffer+readDosHeader->e_lfanew+4+20+readNTheader->FileHeader.SizeOfOptionalHeader);
	PIMAGE_FILE_HEADER pfileheader = &readNTheader->FileHeader;
	int length = pfileheader->NumberOfSections;
	for (int i = 0; i < length; i++)
	{
		printf("==========name:%s===========\n", readSectionHeader[i].Name);  
		printf("磁盘中该节区开始位置:%x\n", readSectionHeader[i].PointerToRawData);
		printf("磁盘中该节区大小:%x\n", readSectionHeader[i].SizeOfRawData);
		printf("内存中该节区开始位置:%x\n", readSectionHeader[i].VirtualAddress);
	}


	free(buffer);
	return 0;
}

filebuffer to imagebuffer to filebuffer

#include<stdio.h>
#include<Windows.h>
#include<iostream>
#pragma warning(disable:4996)
using namespace std;
int len(FILE* pfile)
{
	fseek(pfile, 0, SEEK_END);
	int result = ftell(pfile);
	rewind(pfile);
	return result;
}
int main()
{
	FILE* filebuffer = NULL;
	filebuffer = fopen("C://Users//52511//Desktop//1.exe", "rb");
	FILE* filebuffer1 = fopen("C://Users//52511//Desktop//3.exe", "wb");
	FILE* filebuffer2 = fopen("C://Users//52511//Desktop//4.exe", "wb");
	char* buffer = NULL;
	buffer = (char*)malloc(len(filebuffer));
	memset(buffer, 0, len(filebuffer));
	fread(buffer, 1, len(filebuffer), filebuffer);


	//dos
	PIMAGE_DOS_HEADER rdos = (PIMAGE_DOS_HEADER)buffer;
	//optional
	PIMAGE_OPTIONAL_HEADER rop = (PIMAGE_OPTIONAL_HEADER)(buffer + rdos->e_lfanew + 4 + 20);
	//NT
	PIMAGE_FILE_HEADER pfh = (PIMAGE_FILE_HEADER)(buffer + 4+rdos->e_lfanew);
	//导入dos头
	int imageLength = rop->SizeOfImage;
	char* imagebuffer = (char*)malloc(imageLength * sizeof(char));
	memset(imagebuffer, 0, imageLength);
	int PEheaderSize = rop->SizeOfHeaders;
	memcpy(imagebuffer, buffer, PEheaderSize);
	//导入节
	PIMAGE_SECTION_HEADER rSec = (PIMAGE_SECTION_HEADER)(buffer+rdos->e_lfanew + 4 + 20 + pfh->SizeOfOptionalHeader);
	for (int i = 0; i < pfh->NumberOfSections; i++) 
	{
		memcpy(imagebuffer+ rSec[i].VirtualAddress, buffer+ rSec[i].PointerToRawData, rSec[i].SizeOfRawData);
	}
	fwrite(imagebuffer, 1, imageLength, filebuffer1);



	char* newbuffer = (char*)malloc(sizeof(char) * len(filebuffer));
	memset(newbuffer, 0, len(filebuffer));
	memcpy(newbuffer, imagebuffer, PEheaderSize);
	for (int i = 0; i < pfh->NumberOfSections; i++)
	{
		memcpy(newbuffer+rSec[i].PointerToRawData, imagebuffer + rSec[i].VirtualAddress, rSec[i].SizeOfRawData);
	}

	fwrite(newbuffer, 1, len(filebuffer), filebuffer2);





	fclose(filebuffer);
	fclose(filebuffer1);
	free(buffer);
	free(imagebuffer);
	return 0;
}