滴水6.4号 在高空运行 ImageBase

目标:

在高空运行本程序,内存写入其他程序,修改线程上下文,让其他程序运行

程序还没写完

先写到复制到内存拉伸,还没修复导入表

程序设置固定基址 0x2000000 

把需要读取的程序申请内存在0x400000

重定位表不用修复,但是导入表要按照 系统一样,将IAT表修改成函数的地址

还没写!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

#pragma once
#define _CRT_SECURE_NO_WARNINGS
#include"函数列表.h"
void* readAFile(LPCTSTR lpFileName, LPVOID lpBaseAddress)
{
	//打开文件
	FILE* fp = NULL;
	fp = fopen("E:\\c++\\pe\\进程\\加载进程-隐藏模块\\Debug\\A.exe", "r+b");
	if (fp == NULL)
	{
		printf("打开文件失败\n");
		return NULL;
	}
	fseek(fp, 0, SEEK_END);
	int size = ftell(fp);
	fseek(fp, 0, SEEK_SET);
	void* filebuffer = malloc(size);
	memset(filebuffer, 0, size);
	if (filebuffer == NULL)
	{
		printf("申请内存失败\n");
		return NULL;;
	}
	fread(filebuffer, size, 1, fp);//读取文件到内存
	fclose(fp);												 //关闭文件流
	return filebuffer;
}     
 void* FileToAImageBase(void* filebuffer){
//读取文件的信息
	PIMAGE_DOS_HEADER pDosHeader             = (PIMAGE_DOS_HEADER)filebuffer;                                                      //dos头
	PIMAGE_NT_HEADERS pNtHeader		         = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew);                      //nt头
	PIMAGE_FILE_HEADER pFileHeader           = (PIMAGE_FILE_HEADER)&pNtHeader->FileHeader;                                         //文件头
	PIMAGE_OPTIONAL_HEADER32 pOptionalHeader = (PIMAGE_OPTIONAL_HEADER32)&pNtHeader->OptionalHeader;                               //可选头
	PIMAGE_SECTION_HEADER pSectionHeader     = (PIMAGE_SECTION_HEADER)((DWORD)pOptionalHeader + pFileHeader->SizeOfOptionalHeader);//节头
	DWORD NumberOfSections                   = pFileHeader->NumberOfSections;														//节的数量                                                   //节的数量
	//读取每个节的起始位置
	DWORD* SectioinVirtualAddress =(DWORD*) malloc(NumberOfSections * sizeof(DWORD));
	if (SectioinVirtualAddress == NULL)
	{
		printf("申请内存失败\n");
		return NULL;;
	}
	memset(SectioinVirtualAddress, 0, NumberOfSections * sizeof(DWORD));
	
	//读取每个节在内存中的大小
	DWORD* SectioinSize   = (DWORD*)malloc(NumberOfSections * sizeof(DWORD));
	if (SectioinSize == NULL)
	{
		printf("申请内存失败\n");
		return NULL;;
	}
	memset(SectioinSize, 0, NumberOfSections * sizeof(DWORD));
	//读取每个节在文件中对齐后的大小
	DWORD* SectioinSizeOfRawData = (DWORD*)malloc(NumberOfSections * sizeof(DWORD));
	if (SectioinSizeOfRawData == NULL)
	{
		printf("申请内存失败\n");
		return NULL;
	}
	memset(SectioinSizeOfRawData, 0, NumberOfSections * sizeof(DWORD));
	//读取每个节在文件中的起始位置	
	DWORD* SectioinPointerToRawData = (DWORD*)malloc(NumberOfSections * sizeof(DWORD));	
	if (SectioinPointerToRawData == NULL)
	{
		printf("申请内存失败\n");
		return NULL;;
	}			
	memset(SectioinPointerToRawData, 0, NumberOfSections * sizeof(DWORD));	

	for (int i = 0; i < NumberOfSections; i++)
	{
		SectioinVirtualAddress[i]           = pSectionHeader[i].VirtualAddress;//内存中的起始位置
		SectioinSize[i]                     = pSectionHeader[i].Misc.VirtualSize;//内存中没有对齐的大小
		SectioinSizeOfRawData[i]            = pSectionHeader[i].SizeOfRawData;//文件中对齐后的大小
		SectioinPointerToRawData[i]         = pSectionHeader[i].PointerToRawData;//文件中的起始位置
		printf("第 %d 个节区内存起始位置 %x\n " , i, SectioinVirtualAddress[i]);
		printf("第 %d 个节区内存未对齐大小 %x\n ", i, SectioinSize[i]);
		printf("第 %d 个节区文件起始位置 %x\n " , i, SectioinPointerToRawData[i]);
		printf("第 %d 个节区文件对齐后大小 %x\n ", i, SectioinSizeOfRawData[i]);
		printf("------------------------------\n");
	}
	//定位到IAT表
	DWORD IATRVA = pOptionalHeader->DataDirectory[1].VirtualAddress;
	//拉伸文件到另一个内存区域
	void* lpBaseAddress = VirtualAlloc((LPVOID)0x00400000, pOptionalHeader->SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
	if (lpBaseAddress == NULL)
	{
		printf("申请内存失败\n");
		return NULL;
	}
	//先复制头部信息
	memcpy(lpBaseAddress, filebuffer, pOptionalHeader->SizeOfHeaders);//PE文件头部在文件中的按照文件对齐后的总大小
	//将文件中的数据拷贝到内存中
	for (int i = 0; i < NumberOfSections; i++)
	{
		memcpy((void*)((DWORD)lpBaseAddress + SectioinVirtualAddress[i]), (void*)((DWORD)filebuffer + SectioinPointerToRawData[i]), SectioinSizeOfRawData[i]);//(内存中的起始位置，文件中的起始位置，文件中的大小)
	}
	
}

如果对你有帮助,请点个赞!!!

以鼓励我继续更新,谢谢啦!