linux花指令,PE伪装器[花指令添加器]

作者：Fi7ke

这个是修改PE头骗过PEID的小工具。也就是大家通常所说的给程序添加花指令。原理非常简单，就是给EXE文件加一个PE头，然后写我们的“花指令”。如果你读懂过jingtao的“谈Delphi编程中流的应用”那篇文章的话。相信对这段代码不会陌生，因为这基本原理是一样的。只是代码中有几个数据结构可能是平时极少用到的，都是用来存放PE结构的变量。大家可以参考PE结构方面的资料。(其实看名字应该也能猜出个十有八九)注释我懒得写了，有问题直接跟贴。

unit Unit1;

interface

uses

Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,

Dialogs, ExtCtrls, StdCtrls;

type

TForm1 = class(TForm)

Label1: TLabel;

Edit1: TEdit;

Button1: TButton;

Bevel1: TBevel;

Button3: TButton;

OpenDialog1: TOpenDialog;

procedure FormCreate(Sender: TObject);

procedure Button1Click(Sender: TObject);

procedure Button3Click(Sender: TObject);

procedure obtain;

private

{ Private declarations }

FImageBase: DWORD;

public

{ Public declarations }

end;

THEAD = array[0..63] of byte;

var

Form1: TForm1;

const

MYSECTION = 'Fi7ke';  //添加的节名，自定义

JMPOFF = 43;  //花指令的机器码,Ollydbg加载后随便取

OEPCODE: THEAD = ($55, $8B, $EC, $6A, $FF, $68, $2A, $2C, $0A, $00, $68, $38,

$90, $0D, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89,

$25, $00, $00, $00, $00, $58, $64, $A3, $00, $00, $00, $00,

$58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF,

$E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,

$00, $00, $00, $00);

procedure AddSection(FName: string);

implementation

{$R *.dfm}

procedure AddSection(FName: string);

var

DOSHEADER: IMAGE_DOS_HEADER;

PEHEADER: IMAGE_NT_HEADERS;

SectionHeader: IMAGE_SECTION_HEADER;

MySectionHeader: IMAGE_SECTION_HEADER;

fs: TFileStream;

AddressOfEntryPoint: DWORD;

begin

fs := TFileStream.Create(FName, fmOpenReadWrite +

fmShareDenyWrite);

try

fs.Seek(0, soFromBeginning);

fs.Read(DOSHEADER, sizeof(DOSHEADER));

fs.Seek(DOSHEADER._lfanew, soFromBeginning);

fs.Read(PEHEADER, sizeOf(PEHEADER));

fs.Seek(sizeOf(SectionHeader) *

(PEHEADER.FileHeader.NumberOfSections - 1), soFromCurrent);

fs.Read(SectionHeader, sizeof(IMAGE_SECTION_HEADER));

MySectionHeader.Name[0] := ord('F');

MySectionHeader.Name[1] := ord('i');

MySectionHeader.Name[2] := ord('7');

MySectionHeader.Name[3] := ord('k');

MySectionHeader.Name[4] := ord('e');

MySectionHeader.Name[5] := 0;

MySectionHeader.Name[6] := 0;

MySectionHeader.Name[7] := 0;

MySectionHeader.VirtualAddress := PEHEADER.OptionalHeader.SizeOfImage;

MySectionHeader.Misc.VirtualSize := $200;

MySectionHeader.SizeOfRawData := (MySectionHeader.VirtualAddress div

PEHEADER.OptionalHeader.FileAlignment + 1) * PEHEADER.OptionalHeader.FileAlignment -

PEHEADER.OptionalHeader.SizeOfImage;

MySectionHeader.PointerToRawData :=

SectionHeader.SizeOfRawData + SectionHeader.PointerToRawData;

MySectionHeader.Characteristics := $E0000020;

Inc(PEHEADER.FileHeader.NumberOfSections);

fs.Write(MySectionHeader, sizeOf(MySectionHeader));

fs.Seek(DOSHEADER._lfanew, soFromBeginning);

AddressOfEntryPoint := PEHEADER.OptionalHeader.AddressOfEntryPoint;

PEHEADER.OptionalHeader.AddressOfEntryPoint :=

MySectionHeader.VirtualAddress;

PEHEADER.OptionalHeader.MajorLinkerVersion := 7;

PEHEADER.OptionalHeader.MinorLinkerVersion := 0;

AddressOfEntryPoint := AddressOfEntryPoint +

PEHEADER.OptionalHeader.ImageBase;

asm   //这里说明一下，这是嵌入的汇编代码,寄存器—CPU暂时储存数据的东西，比内存更快，以提高效率

PUSHAD

LEA eax, OEPCODE  //将OEPCODE的地址交给寄存器

ADD eax, JMPOFF   添加JMPOFF值给寄存器

MOV edx, AddressOfEntryPoint   //转移指令，相当于付值语句，左边给右边

MOV DWORD ptr [eax], edx    //同上

POPAD

end;

PEHEADER.OptionalHeader.SizeOfImage :=

PEHEADER.OptionalHeader.SizeOfImage + MySectionHeader.Misc.VirtualSize;

fs.Write(PEHEADER, sizeof(PEHEADER));

fs.Seek(fs.Size, soFromBeginning);

fs.Write(OEPCODE, MySectionHeader.Misc.VirtualSize)

finally

fs.Free;

end;

end;

procedure TForm1.FormCreate(Sender: TObject);

begin

Edit1.Clear;

end;

procedure TForm1.Button1Click(Sender: TObject);

begin

if OpenDialog1.Execute then

Edit1.Text := OpenDialog1.FileName;

end;

procedure TForm1.obtain;

var

DOSHEADER: IMAGE_DOS_HEADER;

PEHEADER: IMAGE_NT_HEADERS;

fs: TFileStream;

begin

fs := TFileStream.Create(Edit1.Text, fmOpenReadWrite +

fmShareDenyWrite);

try

fs.Seek(0, soFromBeginning);

fs.Read(DOSHEADER, sizeof(DOSHEADER));

fs.Seek(DOSHEADER._lfanew, soFromBeginning);

fs.Read(PEHEADER, sizeOf(PEHEADER));

FImageBase := PEHEADER.OptionalHeader.ImageBase;

finally

fs.Free;

end;

end;

procedure TForm1.Button3Click(Sender: TObject);

begin

if trim(Edit1.Text) = '' then

begin

Messagebox(Handle, '请选择你要伪装的程序!', '提示', MB_OK + MB_ICONSTOP);

Exit;

end;

AddSection(Edit1.Text);

Messagebox(Handle, '伪装成功!', '提示', MB_OK + MB_ICONINFORMATION);

end;

end.