PE合并节【内存对齐和文件对其大小不一样版本】

PVOID PE_Headers::CompressSection(IN PVOID File_Buffer)

{

        PVOID newbuff = NULL;

        PBYTE read = NULL, write = NULL;

        DWORD i;

       

        if (File_Buffer == NULL)

        {

                Error_Flag |= EMPTY_IMAGEBUFFER;

                return NULL;

        }

       

        //新生成的文件大小 = 最后节的RVA + 最后节的FOA - 头的RVA + 头的FOA

        File_Size = pSection_Header[pPE_Header->NumberOfSections - 1].VirtualAddress

                + pSection_Header[pPE_Header->NumberOfSections - 1].SizeOfRawData

                - pSection_Header->VirtualAddress + pSection_Header->PointerToRawData;               

        newbuff = malloc(File_Size);

        memset(newbuff, 0, File_Size);

       

        memcpy (newbuff, pDos_Header, pOptional_Header->SizeOfHeaders);                        //拷贝头部

        for (i = 0; i < pPE_Header->NumberOfSections; i++)

        {

                read = (PBYTE) pDos_Header + pSection_Header[i].PointerToRawData;

                write = (PBYTE) newbuff + pSection_Header[i].VirtualAddress

                        - pSection_Header->VirtualAddress + pSection_Header->PointerToRawData;        //因头部的RVA和FOA的不同产生的偏移量

                memcpy(write, read, pSection_Header[i].SizeOfRawData);                       

        }

       

        Release(File_Buffer);

        GetPEHeaders(newbuff);

       

        //合并后，virtualsize = 文件大小 - 头的文件大小

        pSection_Header->Misc.VirtualSize = File_Size - pSection_Header->PointerToRawData;

        pSection_Header->SizeOfRawData = File_Size - pSection_Header->PointerToRawData;

        for (i = 1; i < pPE_Header->NumberOfSections; i++)

        {

                pSection_Header->Characteristics |= pSection_Header[i].Characteristics;                //把每个节的节属性合并到第一个节里

                memset(&pSection_Header[i], 0, sizeof(IMAGE_SECTION_HEADER));                        //把原来节的数据置0，以便新增一个节

        }

        pPE_Header->NumberOfSections = 1;

        return newbuff;

}