#include "stdafx.h"
#define MBXADDR 0x77D66534
#define CODE_LEN 18
#define CODE_RV1 0xD
#define CODE_RV2 0x12
unsigned char CODE[CODE_LEN]={0x6A,0x00,0x6A,0x00,0x6A,0x00,0x6A,0x00,0xE8,0x00,0x00,0x00,0x00,0xE9,0x00,0x00,0x00,0x00};
//返回对齐后的大小,real实际大小,raw对齐大小参数,Size为对齐后大小
long AlignSize(int Real,int Raw)
{
long Size = ( Real % Raw == 0 ? Real:Real/Raw*Raw+Real%Raw*Raw);
return Size;
}
/代码节添加代码///
/*1. 读文件到FileBuffer */
unsigned char* FileBuffer(const char* FileName , const char* Mode,long* pSize)
{
unsigned char* Heap = NULL;
errno_t Err;
FILE* Stream;
Err = fopen_s(&Stream,FileName,Mode);
long Size = 0L;
if(Err != 0)
{
if(DEBUG)
perror("Open file error:");
printf("Open %s as %s mode error!\n",FileName,Mode);
return NULL;
}
// 文件大小
fseek(Stream,0L,SEEK_END);
Size = ftell(Stream);
*pSize = Size;
fseek(Stream,0L,SEEK_SET);
//写入到FileBuffer
Heap = (unsigned char*)malloc(sizeof(char)*Size);
if(Heap == NULL)
{
if(DEBUG)
printf("Create FileBuffer Error!\n");
fclose(Stream);
return NULL;
}
fread(Heap,sizeof(char),Size,Stream);
fclose(Stream);
return Heap;
}
/*2.在FileBuffer里面操作节:添加代码到第一个节 */
int InsertCodeToPEText(unsigned char* Buffer,unsigned char* Code,int CodeSize)
{
//判断是不是PE文件,MZ标志和PE标志
PIMAGE_DOS_HEADER pDosHeader;
PIMAGE_NT_HEADERS32 pNtHeader32;
PIMAGE_NT_HEADERS64 pNtHeader64;
PIMAGE_SECTION_HEADER pSectionHeader;
pDosHeader = (PIMAGE_DOS_HEADER)Buffer;
if(pDosHeader->e_magic != 0x5A4D)
{
perror("Not PE format file !\n");
return -1;
}
pNtHeader32 = (PIMAGE_NT_HEADERS32)(Buffer+pDosHeader->e_lfanew);
if(pNtHeader32->Signature != 0x4550)
{
perror("PE File format fail!\n");
return -1;
}
if (pNtHeader32->FileHeader.SizeOfOptionalHeader != 0xE0)
{
pNtHeader64 =(PIMAGE_NT_HEADERS64)pNtHeader32;
perror("PE is 64Bit!\n");
return 1;
}
//第一个节的文件对齐空间够不够放18个字节
pSectionHeader = (PIMAGE_SECTION_HEADER)(pNtHeader32+1);
int PySize,FAlignSize;
FAlignSize = pSectionHeader->SizeOfRawData;
PySize =pSectionHeader->Misc.VirtualSize;
if(FAlignSize - PySize < CODE_LEN )
{
perror("First Section Free Buffer Less!");
return -1;
}
unsigned char CodeA[100];
int x ;
for(x=0 ;x < CodeSize;x++)
{
CodeA[x] = Code[x];
}
//第一个节的最后位置的内存偏移地址和文件偏移地址的差,用来计算E8 E9 和OEP的位置,要用到的PE有 OP_Header->OEP,Section_h->praw/va sraw/viualsize
long Distance = pSectionHeader->VirtualAddress - pSectionHeader->PointerToRawData; //IMAGEBUFFER和FILEBUFFER的距离
long InsertAV = pNtHeader32->OptionalHeader.ImageBase + pSectionHeader->VirtualAddress + pSectionHeader->Misc.VirtualSize; //添加代码的VA位置
long OldOEP = pNtHeader32->OptionalHeader.ImageBase + pNtHeader32->OptionalHeader.AddressOfEntryPoint; //原文件的OEP+ImageBase
long* JMP = (long*)(CodeA+14);
long* CALL = (long*)(CodeA+9);
*CALL = MBXADDR - InsertAV - CODE_RV1; //CALL MessageBoxW 的X位置
*JMP = OldOEP - InsertAV - CODE_RV2; //JMP回OEP的X位置
/*
for(x=0;x<4;x++)
{
CodeA[9+x]=CALL%0x100;
CALL = CALL/0x100;
CodeA[14+x]=JMP%0x100;
JMP = JMP/0x100;
}
*/
unsigned char* BuffRA = Buffer + pSectionHeader->PointerToRawData+pSectionHeader->Misc.VirtualSize;
int i ;
for( i=0; i<CodeSize;i++)
{
BuffRA[i]=CodeA[i];
}
pNtHeader32->OptionalHeader.AddressOfEntryPoint = InsertAV - pNtHeader32->OptionalHeader.ImageBase;
return 0;
}
/*3.将FileBuffer保存到新文件*/
int SaveBuffer(unsigned char* Buffer,long Size,const char* NewFileN) // 字节为长度单位
{
errno_t Err;
FILE* Stream;
Err = fopen_s(&Stream,NewFileN,"wb");
if(Err != 0)
{
if(DEBUG)
printf("Create New File %s error!\n",NewFileN);
return -1;
}
fwrite(Buffer,sizeof(char),Size,Stream);
fclose(Stream);
return 0;
}
/
#include "stdafx.h"
#define CODE_LEN 18
extern unsigned char CODE[CODE_LEN];
int _tmain(int argc, _TCHAR* argv[])
{
long Size;
unsigned char* Buff = FileBuffer("notepad.exe" , "rb",&Size);
if(Buff == NULL)
return -1;
InsertCodeToPEText(Buff,CODE,CODE_LEN);
SaveBuffer(Buff,Size,"notepad_new.exe");
return 0;
}