需要注意的就是如果在新增节中,需要修改节的属性为可写。
void injectImportTable(char* buffer,int len)
{
FILE* pfile1 = fopen("C://Users//52511//Desktop//6.exe", "wb");
int sectionLen = 0x1000;
int newLen = len + sectionLen;
char* newbuffer=AddNewSection(buffer, newLen, len);
PIMAGE_DOS_HEADER pDosH = (PIMAGE_DOS_HEADER)(newbuffer);
PIMAGE_NT_HEADERS pNTH = (PIMAGE_NT_HEADERS)(newbuffer + pDosH->e_lfanew);
PIMAGE_FILE_HEADER pFH = (PIMAGE_FILE_HEADER)((char*)pNTH + 0x4);
PIMAGE_OPTIONAL_HEADER pOH = (PIMAGE_OPTIONAL_HEADER)((char*)pFH + 0x14);
int opHeaderLen = int(pFH->SizeOfOptionalHeader);
PIMAGE_SECTION_HEADER pSecH = (PIMAGE_SECTION_HEADER)((char*)pOH + opHeaderLen);
PIMAGE_DATA_DIRECTORY pdd = (PIMAGE_DATA_DIRECTORY)(&(pOH->DataDirectory[1]));
int IDDVA = pdd->VirtualAddress;
PIMAGE_IMPORT_DESCRIPTOR pID = (PIMAGE_IMPORT_DESCRIPTOR)(newbuffer + rvaTofoa(IDDVA, newbuffer));
int sizeOfID = pdd->Size;
int numOfSec = pFH->NumberOfSections;
char* start = newbuffer + pSecH[numOfSec - 1].PointerToRawData;
pSecH[numOfSec - 1].Characteristics = 0xFFFFFFFF;
//将导入表全部copy到新节
memcpy(start, pID, sizeOfID);
PIMAGE_IMPORT_DESCRIPTOR newID = (PIMAGE_IMPORT_DESCRIPTOR)(start + sizeOfID-0x14);
//追加导入表
*newID = *pID;
//将新导入表后20字节置零
memset((char*) newID+0x14, 0, 0x14);
//修改导入表属性
pOH->DataDirectory[1].VirtualAddress = pSecH[numOfSec - 1].VirtualAddress;
pOH->DataDirectory[1].Size = sizeOfID + 0x14;
//INT
PDWORD INTstart =(PDWORD) ((char*)newID + 0x14+0x14);
memset(INTstart, 0, 0x8);
//IAT
PDWORD IATstart = (PDWORD)((char*)INTstart + 0x8);
memset(IATstart, 0, 0x8);
//Import by name
PIMAGE_IMPORT_BY_NAME newpIBN =(PIMAGE_IMPORT_BY_NAME) ((char*)IATstart + 0x8);
newpIBN->Hint = 0;
memcpy(&(newpIBN->Name), "ExportFunction", 15);
char* dllName = (char*)(&(newpIBN->Name)) + 15;
int foaOfnewIBN = int((char*)newpIBN - newbuffer);
int rvaOfnewIBN = foaTorva(foaOfnewIBN, newbuffer);
*INTstart = rvaOfnewIBN;
*IATstart = rvaOfnewIBN;
memcpy(dllName, "InjectDll.dll", 14);
newID->Name = foaTorva(int(dllName - newbuffer), newbuffer);
newID->OriginalFirstThunk = foaTorva(int((char*)INTstart - newbuffer), newbuffer);
newID->FirstThunk = foaTorva(int((char*)IATstart - newbuffer), newbuffer);
newID->TimeDateStamp = 0;
fwrite(newbuffer, 1, newLen, pfile1);
}