注入导入表

需要注意的就是如果在新增节中，需要修改节的属性为可写。

void injectImportTable(char* buffer,int len)
{
    FILE* pfile1 = fopen("C://Users//52511//Desktop//6.exe", "wb");
    int sectionLen = 0x1000;
    int newLen = len + sectionLen;
    char* newbuffer=AddNewSection(buffer, newLen, len);
    PIMAGE_DOS_HEADER pDosH = (PIMAGE_DOS_HEADER)(newbuffer);
    PIMAGE_NT_HEADERS pNTH = (PIMAGE_NT_HEADERS)(newbuffer + pDosH->e_lfanew);
    PIMAGE_FILE_HEADER pFH = (PIMAGE_FILE_HEADER)((char*)pNTH + 0x4);
    PIMAGE_OPTIONAL_HEADER pOH = (PIMAGE_OPTIONAL_HEADER)((char*)pFH + 0x14);
    int opHeaderLen = int(pFH->SizeOfOptionalHeader);
    PIMAGE_SECTION_HEADER pSecH = (PIMAGE_SECTION_HEADER)((char*)pOH + opHeaderLen);
    PIMAGE_DATA_DIRECTORY pdd = (PIMAGE_DATA_DIRECTORY)(&(pOH->DataDirectory[1]));
    int IDDVA = pdd->VirtualAddress;
    PIMAGE_IMPORT_DESCRIPTOR pID = (PIMAGE_IMPORT_DESCRIPTOR)(newbuffer + rvaTofoa(IDDVA, newbuffer));
    int sizeOfID = pdd->Size;
    int numOfSec = pFH->NumberOfSections;
    char* start = newbuffer + pSecH[numOfSec - 1].PointerToRawData;
    pSecH[numOfSec - 1].Characteristics = 0xFFFFFFFF;
    //将导入表全部copy到新节
    memcpy(start, pID, sizeOfID);
    PIMAGE_IMPORT_DESCRIPTOR newID = (PIMAGE_IMPORT_DESCRIPTOR)(start + sizeOfID-0x14);
    //追加导入表
    *newID = *pID;
    //将新导入表后20字节置零
    memset((char*) newID+0x14, 0, 0x14);
    //修改导入表属性
    pOH->DataDirectory[1].VirtualAddress = pSecH[numOfSec - 1].VirtualAddress;
    pOH->DataDirectory[1].Size = sizeOfID + 0x14;
    
    //INT
    PDWORD INTstart =(PDWORD) ((char*)newID + 0x14+0x14);
    memset(INTstart, 0, 0x8);
    //IAT
    PDWORD IATstart = (PDWORD)((char*)INTstart + 0x8);
    memset(IATstart, 0, 0x8);
    //Import by name
    PIMAGE_IMPORT_BY_NAME newpIBN =(PIMAGE_IMPORT_BY_NAME) ((char*)IATstart + 0x8);
    newpIBN->Hint = 0;
    memcpy(&(newpIBN->Name), "ExportFunction", 15);
    char* dllName = (char*)(&(newpIBN->Name)) + 15;
    int foaOfnewIBN = int((char*)newpIBN - newbuffer);
    int rvaOfnewIBN = foaTorva(foaOfnewIBN, newbuffer);
    *INTstart = rvaOfnewIBN;
    *IATstart = rvaOfnewIBN;
    memcpy(dllName, "InjectDll.dll", 14);
    newID->Name = foaTorva(int(dllName - newbuffer), newbuffer);
    newID->OriginalFirstThunk = foaTorva(int((char*)INTstart - newbuffer), newbuffer);
    newID->FirstThunk = foaTorva(int((char*)IATstart - newbuffer), newbuffer);
    newID->TimeDateStamp = 0;
    fwrite(newbuffer, 1, newLen, pfile1);

}