PE合并节的主要代码实现，详细注释（内存和文件对齐相同时的版本）

//合并节

//参数：传入拉伸后的imagebuffer

LPVOID MergeSection(LPVOID imagebuffer)

{

PIMAGE_DOS_HEADER pDosHeader4 = NULL;

PIMAGE_NT_HEADERS32 pNTHeader4 = NULL;

PIMAGE_FILE_HEADER pFileHeader4 = NULL;

PIMAGE_OPTIONAL_HEADER32 pOptionHeader4 = NULL;

PIMAGE_SECTION_HEADER pSectionHeader4 = NULL;

LPVOID MergeSec = NULL;

pDosHeader4 = (PIMAGE_DOS_HEADER)imagebuffer;

pNTHeader4 = (PIMAGE_NT_HEADERS32)((DWORD)pDosHeader4 + pDosHeader4->e_lfanew);

pFileHeader4 = (PIMAGE_FILE_HEADER)((DWORD)pNTHeader4 + 4);

pOptionHeader4 = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pFileHeader4 + IMAGE_SIZEOF_FILE_HEADER);

pSectionHeader4 = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader4 + pFileHeader4->SizeOfOptionalHeader);

//取拉伸后这个imagebuffer的大小值

DWORD len =  (pSectionHeader4+4)->VirtualAddress + (pSectionHeader4->SizeOfRawData > pSectionHeader4->Misc.VirtualSize ? pSectionHeader4->SizeOfRawData : pSectionHeader4->Misc.VirtualSize);

//修改sizeofrawdata和misc.virtualsize 为len减去头部大小（一个节的总共大小）,然后统一大小

pSectionHeader4->SizeOfRawData = len-pOptionHeader4->SizeOfHeaders;

pSectionHeader4->Misc.VirtualSize = len-pOptionHeader4->SizeOfHeaders;

int n = 1;

while (n<pFileHeader4->NumberOfSections)

{

pSectionHeader4->Characteristics |= (pSectionHeader4 + n)->Characteristics;

ZeroMemory((char*)pSectionHeader4 + sizeof(IMAGE_SECTION_HEADER)*n, sizeof(IMAGE_SECTION_HEADER));

n++;

}

//修改节数量

pFileHeader4->NumberOfSections = 1;

//修改sizeofimage值

pOptionHeader4->SizeOfImage = len;

//申请内存

MergeSec = malloc(len);

//复制进MergeSec

memcpy(MergeSec, imagebuffer,len);

return MergeSec;