• 【逆向】导出表：1.编写程序打印所有的导出表信息 2.编写GetFunctionAddrByName 3.编写GetFunctionAddrByOrdinal

    这是从数据目录中获取每个表的地址

    1. void PE::Analyze_Data_Directory(Data& my_data)
    2. {
    3. 	my_data.my_Data_Directory = nullptr;
    4. 	my_data.my_Data_Directory = (PIMAGE_DATA_DIRECTORY*)malloc(16 * sizeof(PIMAGE_DATA_DIRECTORY));
    5. 	void* Temp_ptr = my_data.my_optional->DataDirectory;
    6. 	for (int i = 0; i < 16; i++)
    7. 	{
    8. 		my_data.my_Data_Directory[i] = (PIMAGE_DATA_DIRECTORY)Temp_ptr;
    9. 		Temp_ptr = (char*)Temp_ptr + 0x8;
    10. 	}
    11. }

     打印所有导出表的信息：
     

    1. void PE::Print_ExportTable(Data& my_data)
    2. {
    3. 	PIMAGE_EXPORT_DIRECTORY my_export_directory_ptr = (PIMAGE_EXPORT_DIRECTORY)((DWORD)my_data.my_Data_Directory[0]->VirtualAddress + (DWORD)my_data.Stretch_Data);
    4. 	my_data.my_Export_Directory = my_export_directory_ptr;
    5. 	DWORD AddressOfFunctions_ptr = (DWORD)((DWORD)my_export_directory_ptr->AddressOfFunctions + (DWORD)my_data.Stretch_Data);
    6. 	DWORD AddressOfNames_ptr = (DWORD)((DWORD)my_export_directory_ptr->AddressOfNames + (DWORD)my_data.Stretch_Data);
    7. 	DWORD AddressOfNameOrdinals_ptr = (DWORD)((DWORD)my_export_directory_ptr->AddressOfNameOrdinals + (DWORD)my_data.Stretch_Data);
    8.  
    9. 	cout << "---------------AddressOfFunctions------------------" << endl;
    10. 	int number = my_export_directory_ptr->NumberOfFunctions;
    11. 	for (int i = 0; i < number; i++)
    12. 	{
    13. 		cout << i << ": " << "0x" << hex << *((DWORD*)AddressOfFunctions_ptr) << endl;
    14. 		my_data.Export_AddressOfFunction[i] = *((DWORD*)AddressOfFunctions_ptr);
    15. 		AddressOfFunctions_ptr += 0x4;
    16. 		while (*((DWORD*)AddressOfFunctions_ptr) == 0)
    17. 		{
    18. 			AddressOfFunctions_ptr += 0x4;
    19. 		}
    20. 	}
    21.  
    22. 	cout << "---------------------Names------------------" << endl;
    23. 	number = my_export_directory_ptr->NumberOfNames;
    24. 	for (int i = 0; i < number; i++)
    25. 	{
    26. 		strcpy_s(my_data.my_Export_Name[i], (PCHAR)(*(DWORD*)AddressOfNames_ptr + (DWORD)my_data.Stretch_Data));
    27. 		cout << i << ": " << (PCHAR)(*(DWORD*)AddressOfNames_ptr + (DWORD)my_data.Stretch_Data) << endl;
    28. 		AddressOfNames_ptr += 0x4;
    29. 	}
    30.  
    31. 	cout << "----------------------NameOrdinals---------------" << endl;
    32. 	cout << "base: " << my_export_directory_ptr->Base << endl;
    33. 	for (int i = 0; i < number; i++)
    34. 	{
    35. 		cout << i << ": " << *(WORD*)AddressOfNames_ptr << endl;
    36. 		AddressOfNames_ptr += 0x2;
    37. 	}
    38. }

    通过函数名称获取函数在DLL的偏移：

    1. VOID PE::GetFunctionAddrByName(Data& my_data, char* name)
    2. {
    3. 	int i = 0;
    4. 	for (i = 0; i < my_data.my_Export_Directory->NumberOfNames; i++)
    5. 	{
    6. 		if (!strcmp(name, my_data.my_Export_Name[i]))
    7. 		{
    8. 			cout << "成功通过函数名匹配到函数！" << endl;
    9. 			break;
    10. 		}
    11. 		if (i == my_data.my_Export_Directory->NumberOfNames - 1)
    12. 		{
    13. 			cout << "没有匹配到函数名!" << endl;
    14. 			return ;
    15. 		}
    16. 	}
    17. 	cout << "0x" << hex << my_data.Export_AddressOfFunction[i] << endl;
    18. 	
    19. }

    通过函数的序号获取函数在DLL的偏移

    1. VOID PE::GetFunctionAddrByOrdinal(Data& my_data, int ordinal)
    2. {
    3. 	DWORD AddressOfNames_ptr = (DWORD)((DWORD)my_data.my_Export_Directory->AddressOfNameOrdinals + (DWORD)my_data.Stretch_Data);
    4. 	for (int i = 0; i < my_data.my_Export_Directory->NumberOfNames; i++)
    5. 	{
    6. 		if (*(WORD*)AddressOfNames_ptr + my_data.my_Export_Directory->Base == ordinal)
    7. 		{
    8. 			cout << "成功通过函数的序号找到函数地址！" << endl;
    9. 			cout << "0x" << hex << my_data.Export_AddressOfFunction[i] << endl;
    10. 			return;
    11. 		}
    12. 		AddressOfNames_ptr = (DWORD)((char*)AddressOfNames_ptr + 2);
    13. 	}
    14. 	cout << "没有匹配上!" << endl;
    15. }

    完整的代码如下，可以直接改DLL名字完美运行：

    1. #include 
    2. #include 
    3. #include 
    4. #include 
    5. #include 
    6. using namespace std;
    7. #pragma comment(lib,"Dll1.lib") 
    8. extern  __declspec(dllimport)  void Print();
    9. int MAX(int a, int b)
    10. {
    11. 	return a >= b ? a : b;
    12. }
    13.  
    14. class Data
    15. {
    16. public:
    17. 	PIMAGE_DOS_HEADER my_dos;//dos头结构
    18. 	PIMAGE_FILE_HEADER my_file;//file结构
    19. 	PIMAGE_OPTIONAL_HEADER32 my_optional;//可选PE头结构
    20. 	PIMAGE_SECTION_HEADER* my_section;//节表结构
    21. 	PIMAGE_DATA_DIRECTORY* my_Data_Directory;//数据目录结构
    22. 	//0.导出表	1.导入表	2.资源表	3.异常信息表	4.安全证书表	5.重定位表	6.调试信息表	7.版权所以表	
    23. 	//8.全局指针表	9.TLS表	10.加载配置表	11.绑定导入表	12.IAT表	13.延迟绑定表	14.COM信息表	15.未使用
    24. 	CHAR my_Export_Name[50][30];//导出表的名字
    25. 	PIMAGE_EXPORT_DIRECTORY my_Export_Directory; //指向导出表结构的指针
    26. 	DWORD	Export_AddressOfFunction[50];
    27.  
    28.  
    29.  
    30. 	void* Before_Stretch_Data; //指向拉伸前的内容
    31. 	void* Stretch_Data; //指向拉伸后的内容
    32. 	void* Shrink_Data; //指向缩小PE结构的内容
    33.  
    34.  
    35. 	Data()
    36. 	{
    37. 		my_dos = nullptr;//dos头结构
    38. 		my_file = nullptr;//file结构
    39. 		my_optional = nullptr;//可选PE头结构
    40. 		my_section = nullptr;//节表结构
    41. 		my_Data_Directory = nullptr;
    42.  
    43.  
    44. 		Before_Stretch_Data = nullptr; //指向拉伸前的内容
    45. 		Stretch_Data = nullptr; //指向拉伸后的内容
    46. 		Shrink_Data = nullptr; //指向缩小PE结构的内容
    47. 	}
    48.  
    49. 	~Data()
    50. 	{
    51. 		if (Before_Stretch_Data != nullptr)
    52. 		{
    53. 			free(Before_Stretch_Data);
    54. 			Before_Stretch_Data = nullptr;
    55. 		}
    56.  
    57. 		if (Stretch_Data != nullptr)
    58. 		{
    59. 			free(Stretch_Data);
    60. 			Stretch_Data = nullptr;
    61. 		}
    62.  
    63. 		if (Shrink_Data != nullptr)
    64. 		{
    65. 			free(Shrink_Data);
    66. 			Shrink_Data = nullptr;
    67. 		}
    68. 	}
    69.  
    70.  
    71. 	VOID Copy_Before_Strectch_Data(Data my_data); //只深拷贝Before_Strectch_Data
    72. };
    73.  
    74. VOID Data::Copy_Before_Strectch_Data(Data my_data)
    75. {
    76. 	int size = _msize(my_data.Before_Stretch_Data);
    77. 	memcpy_s(this->Before_Stretch_Data, size, my_data.Before_Stretch_Data, size);
    78. }
    79.  
    80.  
    81.  
    82. class PE
    83. {
    84. public:
    85. 	VOID Readfile(char* filename, Data& my_data);  //读取pe文件
    86.  
    87. 	VOID Analyze_PE(Data& my_data, int num);  //分析pe结构
    88.  
    89. 	VOID Stretch_PE(Data& my_data);  //拉伸pe结构
    90.  
    91. 	VOID Shrink_PE(Data& my_data); //缩小pe结构
    92.  
    93. 	VOID New_Section(char* filename, Data& my_data);//新增节，非扩大节，并写入新的exe文件中
    94.  
    95. 	VOID Expand_Section(Data& my_data, char* filename);  //扩大节
    96.  
    97. 	int Section_Align(int temp, Data& my_data); //返回内存对齐后的大小
    98.  
    99. 	int File_Align(int temp, Data& my_data); //返回文件对齐后的大小
    100.  
    101. 	VOID Combine_Section(char* filename, Data& my_data);
    102.  
    103. 	VOID Copy_Data(Data& my_data);
    104.  
    105. 	VOID Print_IMAGE_DATA_DIRECTORY(Data& my_data);
    106.  
    107. 	VOID Analyze_Data_Directory(Data& my_data);
    108.  
    109. 	DWORD  Rva_To_Foa(DWORD Rva_Offset, Data& my_data);
    110.  
    111. 	VOID Print_ExportTable(Data& my_data);
    112.  
    113. 	VOID GetFunctionAddrByName(Data& my_data, char* name);
    114.  
    115. 	VOID GetFunctionAddrByOrdinal(Data& my_data, int ordinal);
    116. };
    117.  
    118. VOID PE::GetFunctionAddrByOrdinal(Data& my_data, int ordinal)
    119. {
    120. 	DWORD AddressOfNames_ptr = (DWORD)((DWORD)my_data.my_Export_Directory->AddressOfNameOrdinals + (DWORD)my_data.Stretch_Data);
    121. 	for (int i = 0; i < my_data.my_Export_Directory->NumberOfNames; i++)
    122. 	{
    123. 		if (*(WORD*)AddressOfNames_ptr + my_data.my_Export_Directory->Base == ordinal)
    124. 		{
    125. 			cout << "成功通过函数的序号找到函数地址！" << endl;
    126. 			cout << "0x" << hex << my_data.Export_AddressOfFunction[i] << endl;
    127. 			return;
    128. 		}
    129. 		AddressOfNames_ptr = (DWORD)((char*)AddressOfNames_ptr + 2);
    130. 	}
    131. 	cout << "没有匹配上!" << endl;
    132. }
    133.  
    134.  
    135. VOID PE::GetFunctionAddrByName(Data& my_data, char* name)
    136. {
    137. 	int i = 0;
    138. 	for (i = 0; i < my_data.my_Export_Directory->NumberOfNames; i++)
    139. 	{
    140. 		if (!strcmp(name, my_data.my_Export_Name[i]))
    141. 		{
    142. 			cout << "成功通过函数名匹配到函数！" << endl;
    143. 			break;
    144. 		}
    145. 		if (i == my_data.my_Export_Directory->NumberOfNames - 1)
    146. 		{
    147. 			cout << "没有匹配到函数名!" << endl;
    148. 			return ;
    149. 		}
    150. 	}
    151. 	cout << "0x" << hex << my_data.Export_AddressOfFunction[i] << endl;
    152. 	
    153. }
    154.  
    155.  
    156. void PE::Print_ExportTable(Data& my_data)
    157. {
    158. 	PIMAGE_EXPORT_DIRECTORY my_export_directory_ptr = (PIMAGE_EXPORT_DIRECTORY)((DWORD)my_data.my_Data_Directory[0]->VirtualAddress + (DWORD)my_data.Stretch_Data);
    159. 	my_data.my_Export_Directory = my_export_directory_ptr;
    160. 	DWORD AddressOfFunctions_ptr = (DWORD)((DWORD)my_export_directory_ptr->AddressOfFunctions + (DWORD)my_data.Stretch_Data);
    161. 	DWORD AddressOfNames_ptr = (DWORD)((DWORD)my_export_directory_ptr->AddressOfNames + (DWORD)my_data.Stretch_Data);
    162. 	DWORD AddressOfNameOrdinals_ptr = (DWORD)((DWORD)my_export_directory_ptr->AddressOfNameOrdinals + (DWORD)my_data.Stretch_Data);
    163.  
    164. 	cout << "---------------AddressOfFunctions------------------" << endl;
    165. 	int number = my_export_directory_ptr->NumberOfFunctions;
    166. 	for (int i = 0; i < number; i++)
    167. 	{
    168. 		cout << i << ": " << "0x" << hex << *((DWORD*)AddressOfFunctions_ptr) << endl;
    169. 		my_data.Export_AddressOfFunction[i] = *((DWORD*)AddressOfFunctions_ptr);
    170. 		AddressOfFunctions_ptr += 0x4;
    171. 		while (*((DWORD*)AddressOfFunctions_ptr) == 0)
    172. 		{
    173. 			AddressOfFunctions_ptr += 0x4;
    174. 		}
    175. 	}
    176.  
    177. 	cout << "---------------------Names------------------" << endl;
    178. 	number = my_export_directory_ptr->NumberOfNames;
    179. 	for (int i = 0; i < number; i++)
    180. 	{
    181. 		strcpy_s(my_data.my_Export_Name[i], (PCHAR)(*(DWORD*)AddressOfNames_ptr + (DWORD)my_data.Stretch_Data));
    182. 		cout << i << ": " << (PCHAR)(*(DWORD*)AddressOfNames_ptr + (DWORD)my_data.Stretch_Data) << endl;
    183. 		AddressOfNames_ptr += 0x4;
    184. 	}
    185.  
    186. 	cout << "----------------------NameOrdinals---------------" << endl;
    187. 	cout << "base: " << my_export_directory_ptr->Base << endl;
    188. 	for (int i = 0; i < number; i++)
    189. 	{
    190. 		cout << i << ": " << *(WORD*)AddressOfNames_ptr << endl;
    191. 		AddressOfNames_ptr += 0x2;
    192. 	}
    193. }
    194.  
    195.  
    196.  
    197.  
    198.  
    199. DWORD PE::Rva_To_Foa(DWORD Rva_Offset, Data& my_data)
    200. {
    201. 	int index = 0;
    202. 	if (Rva_Offset <= my_data.my_optional->SizeOfHeaders)
    203. 	{
    204. 		return Rva_Offset;
    205. 	}
    206. 	else
    207. 	{
    208.  
    209. 		while (Rva_Offset > my_data.my_section[index]->VirtualAddress)
    210. 		{
    211. 			index++;
    212. 		}
    213. 		index--;
    214. 		//计算在节的偏移
    215. 		DWORD Section_Offset = Rva_Offset - my_data.my_section[index]->VirtualAddress;
    216. 		return my_data.my_section[index]->PointerToRawData + Section_Offset;
    217. 	}
    218. }
    219.  
    220. void PE::Analyze_Data_Directory(Data& my_data)
    221. {
    222. 	my_data.my_Data_Directory = nullptr;
    223. 	my_data.my_Data_Directory = (PIMAGE_DATA_DIRECTORY*)malloc(16 * sizeof(PIMAGE_DATA_DIRECTORY));
    224. 	void* Temp_ptr = my_data.my_optional->DataDirectory;
    225. 	for (int i = 0; i < 16; i++)
    226. 	{
    227. 		my_data.my_Data_Directory[i] = (PIMAGE_DATA_DIRECTORY)Temp_ptr;
    228. 		Temp_ptr = (char*)Temp_ptr + 0x8;
    229. 	}
    230. }
    231.  
    232. void PE::Print_IMAGE_DATA_DIRECTORY(Data& my_data)
    233. {
    234. 	char arr[16][40] = {
    235. 	"IMAGE_DIRECTORY_ENTRY_EXPORT",
    236. 	"IMAGE_DIRECTORY_ENTRY_IMPORT",
    237. 	"IMAGE_DIRECTORY_ENTRY_RESOURCE",
    238. 	"IMAGE_DIRECTORY_ENTRY_EXCEPTION",
    239. 	"IMAGE_DIRECTORY_ENTRY_SECURITY",
    240. 	"IMAGE_DIRECTORY_ENTRY_BASERELOC",
    241. 	"IMAGE_DIRECTORY_ENTRY_DEBUG",
    242. 	"IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
    243. 	"IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
    244. 	"IMAGE_DIRECTORY_ENTRY_TLS",
    245. 	"IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
    246. 	"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
    247. 	"IMAGE_DIRECTORY_ENTRY_IAT",
    248. 	"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
    249. 	"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
    250. 	"RESERVED"
    251. 	};
    252.  
    253. 	for (int i = 0; i < 16; i++)
    254. 	{
    255. 		cout << arr[i] << " :" << endl;
    256. 		cout << "Size: " << hex << my_data.my_Data_Directory[i]->Size << endl;
    257. 		cout << "Virtual_Address: " << my_data.my_Data_Directory[i]->VirtualAddress << endl;
    258. 		cout << "------------------------------------------------------------------------" << endl;
    259. 	}
    260. 	return;
    261. }
    262.  
    263.  
    264. void PE::Combine_Section(char* filename, Data& my_data)
    265. {
    266.  
    267. 	int Max = MAX(my_data.my_section[my_data.my_file->NumberOfSections - 1]->SizeOfRawData, my_data.my_section[my_data.my_file->NumberOfSections - 1]->Misc.VirtualSize);
    268. 	int Size = my_data.my_section[my_data.my_file->NumberOfSections - 1]->VirtualAddress + Section_Align(Max, my_data) - Section_Align(my_data.my_optional->SizeOfHeaders, my_data) + MAX(my_data.my_section[0]->SizeOfRawData, my_data.my_section[0]->Misc.VirtualSize);
    269. 	Data Comebine_Data;
    270. 	int temp_size = _msize(my_data.Stretch_Data) + Max;
    271. 	Comebine_Data.Stretch_Data = (void*)malloc(temp_size);
    272. 	memset(Comebine_Data.Stretch_Data, 0, Size);
    273.  
    274. 	temp_size = _msize(my_data.Stretch_Data);
    275. 	memcpy_s(Comebine_Data.Stretch_Data, temp_size, my_data.Stretch_Data, temp_size);
    276. 	Analyze_PE(Comebine_Data, 2);
    277.  
    278. 	void* temp_ptr = (char*)Comebine_Data.Stretch_Data + Max + my_data.my_section[my_data.my_file->NumberOfSections - 1]->VirtualAddress;
    279. 	memcpy_s(temp_ptr, MAX(my_data.my_section[0]->SizeOfRawData, my_data.my_section[0]->Misc.VirtualSize), my_data.my_section[0]->VirtualAddress + (char*)my_data.Stretch_Data, MAX(my_data.my_section[0]->SizeOfRawData, my_data.my_section[0]->Misc.VirtualSize));
    280.  
    281. 	Comebine_Data.my_optional->SizeOfImage += Section_Align(MAX(my_data.my_section[0]->SizeOfRawData, my_data.my_section[0]->Misc.VirtualSize), my_data);
    282.  
    283. 	Comebine_Data.my_section[my_data.my_file->NumberOfSections - 1]->SizeOfRawData += File_Align(MAX(my_data.my_section[0]->SizeOfRawData, my_data.my_section[0]->Misc.VirtualSize), my_data);
    284. 	Comebine_Data.my_section[my_data.my_file->NumberOfSections - 1]->Misc.VirtualSize = Section_Align(Comebine_Data.my_section[my_data.my_file->NumberOfSections - 1]->Misc.VirtualSize, my_data) + Section_Align(MAX(my_data.my_section[0]->SizeOfRawData, my_data.my_section[0]->Misc.VirtualSize), my_data);
    285.  
    286. 	FILE* my_file;
    287. 	if (fopen_s(&my_file, filename, "wb") != 0)
    288. 	{
    289. 		cout << "打开文件失败" << endl;
    290. 		return;
    291. 	}
    292.  
    293. 	Shrink_PE(Comebine_Data);
    294. 	Analyze_PE(Comebine_Data, 3);
    295.  
    296. 	fwrite(Comebine_Data.Shrink_Data, 1, _msize(Comebine_Data.Shrink_Data), my_file);
    297. 	cout << "写入成功！" << endl;
    298.  
    299. 	fclose(my_file);
    300. }
    301.  
    302.  
    303. void PE::Expand_Section(Data& my_data, char* filename)
    304. {
    305. 	this->Stretch_PE(my_data);
    306. 	unsigned Size = 0;//扩大节后新的文件大小
    307. 	Size = my_data.my_optional->ImageBase + Section_Align(MAX(my_data.my_section[0]->SizeOfRawData, my_data.my_section[0]->Misc.VirtualSize), my_data);
    308.  
    309. 	Data Expand_Data;
    310. 	Expand_Data.Stretch_Data = (void*)malloc(Size);
    311. 	memset(Expand_Data.Stretch_Data, 0, Size);
    312. 	memcpy_s(Expand_Data.Stretch_Data, _msize(my_data.Stretch_Data), my_data.Stretch_Data, _msize(my_data.Stretch_Data));
    313.  
    314. 	Analyze_PE(Expand_Data, 2);
    315.  
    316. 	Expand_Data.my_section[my_data.my_file->NumberOfSections - 1]->SizeOfRawData = Section_Align(MAX(my_data.my_section[0]->SizeOfRawData, my_data.my_section[0]->Misc.VirtualSize), my_data) + Section_Align(MAX(my_data.my_section[my_data.my_file->NumberOfSections - 1]->SizeOfRawData, my_data.my_section[my_data.my_file->NumberOfSections - 1]->Misc.VirtualSize), my_data);
    317. 	Expand_Data.my_section[my_data.my_file->NumberOfSections - 1]->Misc.VirtualSize = Expand_Data.my_section[my_data.my_file->NumberOfSections - 1]->SizeOfRawData;
    318.  
    319. 	Expand_Data.my_optional->SizeOfImage += Section_Align(MAX(my_data.my_section[0]->SizeOfRawData, my_data.my_section[0]->Misc.VirtualSize), my_data);
    320.  
    321. 	void* Temp_Ptr = (char*)Expand_Data.Stretch_Data + Expand_Data.my_section[Expand_Data.my_file->NumberOfSections - 1]->VirtualAddress + Section_Align(MAX(my_data.my_section[Expand_Data.my_file->NumberOfSections - 1]->SizeOfRawData, my_data.my_section[Expand_Data.my_file->NumberOfSections - 1]->Misc.VirtualSize), my_data);
    322. 	int temp_size = Section_Align(MAX(my_data.my_section[0]->SizeOfRawData, my_data.my_section[0]->Misc.VirtualSize), my_data);
    323. 	void* Temp_Ptr2 = (char*)my_data.Stretch_Data + my_data.my_section[0]->VirtualAddress;
    324.  
    325. 	memcpy_s(Temp_Ptr, temp_size, Temp_Ptr2, temp_size);
    326.  
    327.  
    328. 	Shrink_PE(Expand_Data);
    329.  
    330. 	FILE* my_file;
    331. 	if (fopen_s(&my_file, filename, "wb") != 0)
    332. 	{
    333. 		cout << "打开文件失败！" << endl;
    334.  
    335. 	}
    336. 	else
    337. 	{
    338. 		Size = _msize(Expand_Data.Shrink_Data);
    339. 		fwrite(Expand_Data.Shrink_Data, 1, Size, my_file);
    340. 		cout << "写入成功！" << endl;
    341. 	}
    342. 	fclose(my_file);
    343. }
    344.  
    345.  
    346. int PE::Section_Align(int temp, Data& my_data)
    347. {
    348. 	int i = 0;
    349. 	while (temp > i * my_data.my_optional->SectionAlignment)
    350. 	{
    351. 		i++;
    352. 	}
    353. 	return i * my_data.my_optional->SectionAlignment;
    354.  
    355. }
    356.  
    357. int PE::File_Align(int temp, Data& my_data)
    358. {
    359. 	int i = 0;
    360. 	while (temp > i * my_data.my_optional->FileAlignment)
    361. 	{
    362. 		i++;
    363. 	}
    364. 	return i * my_data.my_optional->FileAlignment;
    365. }
    366.  
    367. void PE::New_Section(char* filename, Data& my_data)
    368. {
    369. 	unsigned int Size; //Size是新文件的大小，是原来的文件大小加上.VirtualSize和SizeOfRawData较大的那个
    370. 	Size = my_data.my_optional->SizeOfHeaders;
    371. 	for (int i = 0; i < my_data.my_file->NumberOfSections; i++)
    372. 	{
    373. 		Size += my_data.my_section[i]->SizeOfRawData;
    374. 	}
    375. 	Size += my_data.my_section[0]->SizeOfRawData;//这是最终新的文件的大小
    376.  
    377. 	Data New_Data;
    378. 	New_Data.Before_Stretch_Data = (void*)malloc(Size * 1);
    379. 	memset(New_Data.Before_Stretch_Data, 0, Size);
    380. 	memcpy_s(New_Data.Before_Stretch_Data, Size, my_data.Before_Stretch_Data, Size - my_data.my_section[0]->SizeOfRawData);//将原来的文件复制过来
    381.  
    382. 	Analyze_PE(New_Data, 1);//让New_Data的dos,file,optional,section有数据
    383.  
    384. 	//复制新的节表
    385. 	void* Temp_ptr1 = (char*)my_data.Before_Stretch_Data + 0x98 + my_data.my_file->SizeOfOptionalHeader;
    386. 	void* Temp_ptr2 = (char*)New_Data.Before_Stretch_Data + 0x98 + my_data.my_file->SizeOfOptionalHeader + my_data.my_file->NumberOfSections * 0x28;
    387. 	memcpy_s(Temp_ptr2, 0x28, Temp_ptr1, 0x28);
    388. 	//复制新的节
    389. 	Temp_ptr1 = (char*)my_data.Before_Stretch_Data + my_data.my_optional->SizeOfHeaders;//指向.text段
    390. 	Temp_ptr2 = (char*)New_Data.Before_Stretch_Data + Size - my_data.my_section[0]->SizeOfRawData;
    391.  
    392. 	memcpy_s(Temp_ptr2, my_data.my_section[0]->SizeOfRawData, Temp_ptr1, my_data.my_section[0]->SizeOfRawData);//复制完.text段作为新增节
    393.  
    394. 	//接下来要改Header的各项数据
    395. 	New_Data.my_file->NumberOfSections++;
    396. 	New_Data.my_optional->SizeOfImage += my_data.my_section[0]->SizeOfRawData;
    397.  
    398. 	Analyze_PE(New_Data, 1);
    399. 	New_Data.my_section[New_Data.my_file->NumberOfSections - 1]->PointerToRawData = New_Data.my_section[New_Data.my_file->NumberOfSections - 2]->PointerToRawData + New_Data.my_section[New_Data.my_file->NumberOfSections - 2]->SizeOfRawData;
    400. 	int size;
    401. 	if (New_Data.my_section[New_Data.my_file->NumberOfSections - 2]->Misc.VirtualSize >= New_Data.my_section[New_Data.my_file->NumberOfSections - 2]->SizeOfRawData)
    402. 	{
    403. 		size = New_Data.my_section[New_Data.my_file->NumberOfSections - 2]->Misc.VirtualSize;
    404. 	}
    405. 	else
    406. 	{
    407. 		size = New_Data.my_section[New_Data.my_file->NumberOfSections - 2]->SizeOfRawData;
    408. 	}
    409. 	size = size / my_data.my_optional->SectionAlignment + my_data.my_optional->SectionAlignment;
    410. 	New_Data.my_section[New_Data.my_file->NumberOfSections - 1]->VirtualAddress = New_Data.my_section[New_Data.my_file->NumberOfSections - 2]->VirtualAddress + size;
    411.  
    412. 	FILE* my_file;
    413. 	if (fopen_s(&my_file, filename, "wb") == 0)
    414. 	{
    415. 		fwrite(New_Data.Before_Stretch_Data, 1, Size, my_file);
    416. 		cout << "写入成功！" << endl;
    417. 		return;
    418. 	}
    419. 	else
    420. 	{
    421. 		cout << "打开文件失败" << endl;
    422. 		return;
    423. 	}
    424. 	fclose(my_file);
    425. }
    426.  
    427.  
    428. void PE::Readfile(char* filename, Data& my_data)
    429. {
    430. 	unsigned int size;
    431. 	FILE* datafile;
    432. 	void* data;
    433. 	//打开文件
    434. 	if (fopen_s(&datafile, filename, "rb") != 0)
    435. 	{
    436. 		cout << "打开文件失败" << endl;
    437. 		return;
    438. 	}
    439.  
    440.  
    441. 	else
    442. 	{
    443. 		//获取文件的大小
    444. 		cout << "打开文件成功！" << endl;
    445. 		fseek(datafile, 0, SEEK_END);
    446. 		size = ftell(datafile);
    447. 		fseek(datafile, 0, SEEK_SET);
    448. 		if (size == -1L)
    449. 		{
    450. 			cout << "文件大小判断失败！" << endl;
    451. 			return;
    452. 		}
    453.  
    454. 		//申请内存空间把文件内容保存下来
    455. 		my_data.Before_Stretch_Data = (void*)malloc(size * sizeof(char));
    456.  
    457. 		if (fread_s(my_data.Before_Stretch_Data, size, sizeof(char), size, datafile) == 0)
    458. 		{
    459. 			cout << "写入数据失败！" << endl;
    460. 			return;
    461. 		}
    462. 		cout << "写入数据成功，成功获取Data!" << endl;
    463. 		return;
    464. 	}
    465.  
    466. }
    467.  
    468. //分析PE结构
    469. void PE::Analyze_PE(Data& data, int num)
    470. {
    471. 	if (num == 1)
    472. 	{
    473. 		if (data.Before_Stretch_Data != nullptr)
    474. 		{
    475. 			DWORD* Temp_ptr = (DWORD*)data.Before_Stretch_Data;
    476. 			data.my_dos = (PIMAGE_DOS_HEADER)Temp_ptr;
    477.  
    478. 			Temp_ptr = (DWORD*)((char*)data.Before_Stretch_Data + data.my_dos->e_lfanew);
    479. 			Temp_ptr++;
    480. 			data.my_file = (PIMAGE_FILE_HEADER)Temp_ptr;
    481.  
    482. 			Temp_ptr = (DWORD*)((char*)Temp_ptr + 0x14);
    483. 			data.my_optional = (PIMAGE_OPTIONAL_HEADER)Temp_ptr;
    484.  
    485.  
    486. 			Temp_ptr = (DWORD*)((char*)data.my_optional + data.my_file->SizeOfOptionalHeader);
    487. 			data.my_section = (PIMAGE_SECTION_HEADER*)malloc(sizeof(PIMAGE_SECTION_HEADER) * data.my_file->NumberOfSections);
    488. 			memset(data.my_section, 0, sizeof(PIMAGE_SECTION_HEADER) * data.my_file->NumberOfSections);
    489. 			for (int i = 0; i < data.my_file->NumberOfSections; i++)
    490. 			{
    491. 				data.my_section[i] = (PIMAGE_SECTION_HEADER)Temp_ptr;
    492. 				Temp_ptr = (DWORD*)((char*)Temp_ptr + 0x28);
    493. 			}
    494. 			return;
    495. 		}
    496. 		cout << "分析PE结构失败！" << endl;
    497. 	}
    498.  
    499. 	if (num == 2)
    500. 	{
    501. 		if (data.Stretch_Data != nullptr)
    502. 		{
    503. 			DWORD* Temp_ptr = (DWORD*)data.Stretch_Data;
    504. 			data.my_dos = (PIMAGE_DOS_HEADER)Temp_ptr;
    505.  
    506. 			Temp_ptr = (DWORD*)((char*)data.Stretch_Data + data.my_dos->e_lfanew);
    507. 			Temp_ptr++;
    508. 			data.my_file = (PIMAGE_FILE_HEADER)Temp_ptr;
    509.  
    510. 			Temp_ptr = (DWORD*)((char*)Temp_ptr + 0x14);
    511. 			data.my_optional = (PIMAGE_OPTIONAL_HEADER)Temp_ptr;
    512.  
    513. 			Temp_ptr = (DWORD*)((char*)data.my_optional + data.my_file->SizeOfOptionalHeader);
    514. 			data.my_section = nullptr;
    515. 			data.my_section = (PIMAGE_SECTION_HEADER*)malloc(sizeof(PIMAGE_SECTION_HEADER) * data.my_file->NumberOfSections);
    516. 			for (int i = 0; i < data.my_file->NumberOfSections; i++)
    517. 			{
    518. 				data.my_section[i] = (PIMAGE_SECTION_HEADER)Temp_ptr;
    519. 				Temp_ptr = (DWORD*)((char*)Temp_ptr + 0x28);
    520. 			}
    521. 			return;
    522. 		}
    523. 		cout << "分析PE结构失败！" << endl;
    524. 	}
    525.  
    526. 	if (num == 3)
    527. 	{
    528. 		if (data.Shrink_Data != nullptr)
    529. 		{
    530. 			DWORD* Temp_ptr = (DWORD*)data.Shrink_Data;
    531. 			data.my_dos = (PIMAGE_DOS_HEADER)Temp_ptr;
    532.  
    533. 			Temp_ptr = (DWORD*)((char*)data.Shrink_Data + data.my_dos->e_lfanew);
    534. 			Temp_ptr++;
    535. 			data.my_file = (PIMAGE_FILE_HEADER)Temp_ptr;
    536.  
    537. 			Temp_ptr = (DWORD*)((char*)Temp_ptr + 0x14);
    538. 			data.my_optional = (PIMAGE_OPTIONAL_HEADER)Temp_ptr;
    539.  
    540. 			Temp_ptr = (DWORD*)((char*)data.my_optional + data.my_file->SizeOfOptionalHeader);
    541. 			data.my_section = (PIMAGE_SECTION_HEADER*)malloc(sizeof(PIMAGE_SECTION_HEADER) * data.my_file->NumberOfSections);
    542. 			for (int i = 0; i < data.my_file->NumberOfSections; i++)
    543. 			{
    544. 				data.my_section[i] = (PIMAGE_SECTION_HEADER)Temp_ptr;
    545. 				Temp_ptr = (DWORD*)((char*)Temp_ptr + 0x28);
    546. 			}
    547. 			return;
    548. 		}
    549. 		cout << "分析pe结构失败!" << endl;
    550. 	}
    551.  
    552. }
    553.  
    554. //拉伸PE结构   注意看PIMAGE_XXX_HEADER的定义，它们本就是指向结构体的指针
    555. void PE::Stretch_PE(Data& my_data)
    556. {
    557. 	unsigned Memory_Size = 0;
    558. 	Memory_Size = my_data.my_optional->SizeOfImage;
    559. 	my_data.Stretch_Data = (void*)malloc(sizeof(char) * Memory_Size);
    560. 	memset(my_data.Stretch_Data, 0, Memory_Size);
    561. 	void* temp_before_stretch_data_ptr = my_data.Before_Stretch_Data;
    562. 	int size_of_dos = 0x40;
    563. 	int size_of_junk = 0x40;
    564. 	int size_of_file = 0x18;
    565. 	unsigned Size_Of_Optional = my_data.my_file->SizeOfOptionalHeader;
    566. 	unsigned Size_Of_Section = 0x28;
    567. 	unsigned Size_Of_Header = my_data.my_optional->SizeOfHeaders;//还未对齐
    568. 	memcpy_s(my_data.Stretch_Data, Memory_Size, my_data.Before_Stretch_Data, Size_Of_Header);
    569. 	void* temp_stretch_data = my_data.Stretch_Data;
    570. 	//现在计算head头对齐后的大小
    571. 	int Size = Size_Of_Header % my_data.my_optional->SectionAlignment;
    572. 	Size_Of_Header = my_data.my_optional->SectionAlignment * Size;
    573.  
    574.  
    575. 	for (int i = 0; i < my_data.my_file->NumberOfSections; i++)
    576. 	{
    577. 		temp_stretch_data = (void*)((char*)my_data.Stretch_Data + my_data.my_section[i]->VirtualAddress);
    578. 		temp_before_stretch_data_ptr = (void*)((char*)my_data.Before_Stretch_Data + my_data.my_section[i]->PointerToRawData);
    579. 		memcpy_s(temp_stretch_data, my_data.my_section[i]->SizeOfRawData, temp_before_stretch_data_ptr, my_data.my_section[i]->SizeOfRawData);
    580. 	}
    581. 	cout << "拉伸成功" << endl;
    582. }
    583.  
    584.  
    585.  
    586. void PE::Shrink_PE(Data& my_data)
    587. {
    588. 	unsigned int Size = 0;
    589. 	Size = my_data.my_section[my_data.my_file->NumberOfSections - 1]->PointerToRawData + my_data.my_section[my_data.my_file->NumberOfSections - 1]->SizeOfRawData;
    590. 	my_data.Shrink_Data = (void*)malloc(Size);
    591. 	memset(my_data.Shrink_Data, 0, Size);
    592. 	//从Stretch_Data缩小
    593.  
    594. 	//复制Heads
    595. 	memcpy_s(my_data.Shrink_Data, my_data.my_optional->SizeOfHeaders, my_data.Stretch_Data, my_data.my_optional->SizeOfHeaders);
    596.  
    597. 	//复制节
    598. 	void* temp_shrink_data_ptr = my_data.Shrink_Data;
    599. 	void* temp_stretch_data_ptr = my_data.Stretch_Data;
    600. 	for (int i = 0; i < my_data.my_file->NumberOfSections; i++)
    601. 	{
    602. 		temp_shrink_data_ptr = (void*)((char*)my_data.Shrink_Data + my_data.my_section[i]->PointerToRawData);
    603. 		temp_stretch_data_ptr = (void*)((char*)my_data.Stretch_Data + my_data.my_section[i]->VirtualAddress);
    604. 		memcpy_s(temp_shrink_data_ptr, my_data.my_section[i]->SizeOfRawData, temp_stretch_data_ptr, my_data.my_section[i]->SizeOfRawData);
    605. 	}
    606. 	cout << "缩小成功" << endl;
    607. 	return;
    608.  
    609. }
    610.  
    611.  
    612. int main()
    613. {
    614. 	char filename[100] = "Dll1.dll";
    615. 	PE my_pe;
    616. 	Data my_data;
    617. 	my_pe.Readfile(filename, my_data);
    618. 	my_pe.Analyze_PE(my_data, 1);   //char*& Data, PIMAGE_DOS_HEADER& dos, PIMAGE_FILE_HEADER& file, PIMAGE_OPTIONAL_HEADER32& optional, PIMAGE_SECTION_HEADER*& section
    619. 	my_pe.Stretch_PE(my_data);
    620. 	my_pe.Shrink_PE(my_data);
    621. 	my_pe.Analyze_Data_Directory(my_data);
    622. 	my_pe.Print_IMAGE_DATA_DIRECTORY(my_data);
    623. 	my_pe.Print_ExportTable(my_data);
    624. 	cout << "转化的文件偏移是" << hex << my_pe.Rva_To_Foa(0x3100, my_data) << endl;
    625. 	//((void(*)())addr)();//调用
    626. 	HMODULE hDll = GetModuleHandleA("Dll1.dll");
    627. 	my_pe.GetFunctionAddrByName(my_data, (char*)"Print");
    628. 	my_pe.GetFunctionAddrByOrdinal(my_data, 14);
    629. 	return 0;
    630. }

    注意注意：有个踩过的坑我想分享给大家。
    就是我本来想这样搞：
    申请一个堆，里面存Dll的数据，通过分析可以找到Dll文件中函数的偏移嘛，然后我就想着，这个偏移，加上堆的基地址，赋值给一个函数指针，那不是直接就可以调用吗？
    结果我试了半天，最后获得函数的真正地址也是正确的，结果就是运行不起来，tnnd，搞了好久，最后经过高人指点才知道，原来堆也是需要有运行权限的，貌似堆貌似没有运行权限。哎，搞死了，呜呜。
     

  • 相关阅读:
    【Leetcode】1825. Finding MK Average
    【世界杯】free-api-worldcup2022 免费世界杯API
    【机械仿真】基于matlab打桩机运动学仿真【含Matlab源码 2101期】
    在原生APP中集成Unity容器
    【数据结构】单链表
    一键式文件共享软件Jirafeau
    数据结构与算法之字典: Leetcode 3. 无重复字符的最长子串 (Typescript版)
    【MQTT从入门到提高系列 | 09】WireShark抓包分析MQTT报文
    【记录】打印｜用浏览器生成证件照打印PDF，打印在任意尺寸的纸上（简单无损！）
    利用EMQX建立MQTT服务器通讯
  • 原文地址：https://blog.csdn.net/fzucaicai/article/details/133800313