<原创>在PE最后一节中插入补丁程序（附代码）

完整文件  https://files.cnblogs.com/Files/Gotogoo/在PE最后一节中插入补丁程序.zip

在PE文件最后一节中插入补丁程序，是最简单也是最有效的一种，因为PE最后一节的数据在文件的末尾，将代码加到最后一节时，不需要修改太多的内容。

最近在学习python，没时间详细写这个了，有问题看代码，或者在评论区提问，或者看书《Windows PE权威指南》，讲的很详细。

#include "stdafx.h"
#include<Windows.h>

char szTargetPath[MAX_PATH]  = "D:\Target.exe";          //目标文件的路径
char szPatchPath[MAX_PATH]   = "D:\helloworld_1.exe";    //补丁文件的路径
char szModifyPEPath[MAX_PATH]= "D:\Modified_PE.exe";     //修改后生成新文件的路径
enum PATCH_FILE_INFO
{
    FileAlignSectionSize,
    RealSectionSize,
    SectionRVA,
    AddressOfEntryPoint,
    FileAlignment
};

PVOID GetFileBaseAddressAndSize(char* szFilePath,PULONG ulFileSize );
BOOL InsertPatchFileToTargetFile(PVOID lpTargetMemory,PVOID lpPatchMemory,ULONG ulTargetSize);
DWORD GetFileInfo(PVOID FileBaseAddress,PATCH_FILE_INFO Type);
VOID ModifyParameter(PVOID FileBaseAddress,ULONG ulTargetSize,ULONG ulFlieAlignPatchCodeSize,ULONG ulRealPatchCodeSize,ULONG ulNewOEP);
ULONG GetPathCodeSectionRVA(PVOID lpPatchMemory);
ULONG Align(ULONG FileSize,ULONG ulAlignment);
ULONG FileAlign(ULONG FileSize,ULONG ulFileAlignment);
ULONG GetNewFileOEP(PVOID lpTargetMemory);
VOID ModifyPatchCodeJumpAddress(PVOID lpNewFileBaseAddress,ULONG NewFileSize,ULONG ULNewFileOEP,ULONG ulOldOEP,ULONG ulRealPatchCodeSize);

int _tmain(int argc, _TCHAR* argv[])
{
    PVOID lpPatchMemory  = NULL;
    PVOID lpTargetMemory = NULL;
    ULONG ulPatchSize    = 0; 
    ULONG ulTargetSize   = 0;

    lpTargetMemory = GetFileBaseAddressAndSize(szTargetPath,&ulTargetSize);
    lpPatchMemory  = GetFileBaseAddressAndSize(szPatchPath,&ulPatchSize);

    InsertPatchFileToTargetFile(lpTargetMemory,lpPatchMemory,ulTargetSize);

    return 0;
}

BOOL InsertPatchFileToTargetFile(PVOID lpTargetMemory,PVOID lpPatchMemory,ULONG ulTargetSize)
{
    DWORD dwFileAlignPatchCodeSize = 0;
    DWORD dwRealPatchCodeSize      = 0;
    ULONG ulPathCodeSectionRVA     = 0;
    ULONG ULNewFileOEP             = 0;
    ULONG ulOldOEP                 = 0;
    ULONG ulFileAlignment          = 0;
    
    
    dwRealPatchCodeSize      = GetFileInfo(lpPatchMemory,RealSectionSize);        //获得Patch文件未对齐时的大小
    ulPathCodeSectionRVA     = GetFileInfo(lpPatchMemory,SectionRVA);              //获得Patch文件所要加载节的RVA
    ulOldOEP                 = GetFileInfo(lpTargetMemory,AddressOfEntryPoint);
    ulFileAlignment          = GetFileInfo(lpTargetMemory,FileAlignment);
    ULNewFileOEP             = GetNewFileOEP(lpTargetMemory);        
    dwFileAlignPatchCodeSize = Align(dwRealPatchCodeSize,ulFileAlignment);
    
    PVOID NewFileBaseAddress = malloc(ulTargetSize+dwFileAlignPatchCodeSize);
    memset(NewFileBaseAddress,0,ulTargetSize+dwFileAlignPatchCodeSize);

    memcpy(NewFileBaseAddress,lpTargetMemory,ulTargetSize);
    memcpy((PVOID)((ULONG_PTR)NewFileBaseAddress+ulTargetSize),(PVOID)((ULONG_PTR)lpPatchMemory+ulPathCodeSectionRVA),dwRealPatchCodeSize);


    ModifyPatchCodeJumpAddress(NewFileBaseAddress,ulTargetSize+dwRealPatchCodeSize,ULNewFileOEP,ulOldOEP,dwRealPatchCodeSize);   //修改PatchCode结尾E9跳转地址

    ModifyParameter(NewFileBaseAddress,ulTargetSize,dwFileAlignPatchCodeSize,dwRealPatchCodeSize,ULNewFileOEP);                  //修改最后一节和PE头的参数


    HANDLE hNewFile = CreateFileA(szModifyPEPath,GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_ARCHIVE,NULL);
    if(hNewFile == INVALID_HANDLE_VALUE)
    {
        printf("CreateFileA Failed！
");
        return FALSE;
    }
    DWORD dwRet = 0;
    if(WriteFile(hNewFile,NewFileBaseAddress,ulTargetSize+dwFileAlignPatchCodeSize,&dwRet,NULL) == 0)                  
    {
        printf("WriteFile Failed！
");
        return FALSE;
    }
    else
    {
        printf("Succeed！
");
    }

    return TRUE;
    

}
ULONG GetNewFileOEP(PVOID lpTargetMemory)
{
    PIMAGE_DOS_HEADER DosHead         = (PIMAGE_DOS_HEADER)lpTargetMemory;
    PIMAGE_NT_HEADERS NTHead          = (PIMAGE_NT_HEADERS)((ULONG_PTR)DosHead+DosHead->e_lfanew);
    PIMAGE_SECTION_HEADER SectionHead = (PIMAGE_SECTION_HEADER)((ULONG_PTR)NTHead+sizeof(IMAGE_NT_HEADERS));

    ULONG ulNumberOfSection = NTHead->FileHeader.NumberOfSections;
    ULONG ulNewFileOEP      = SectionHead[ulNumberOfSection-1].VirtualAddress+SectionHead[ulNumberOfSection-1].SizeOfRawData;
    return ulNewFileOEP;
}
VOID ModifyPatchCodeJumpAddress(PVOID lpNewFileBaseAddress,ULONG NewFileSize,ULONG ULNewFileOEP,ULONG ulOldOEP,ULONG ulRealPatchCodeSize)
{
    UCHAR JmpCode[] = "x00x00x00x00";    
    *(int*)JmpCode  = ( ulOldOEP + 1) -  ( ULNewFileOEP + ulRealPatchCodeSize );                        //+1越过E9
    memcpy((PVOID)((UCHAR*)lpNewFileBaseAddress + NewFileSize - 5),JmpCode,strlen((char*)JmpCode));    //看内存  E9后有5个非0字节，所以不是-4
    
}

VOID ModifyParameter(PVOID FileBaseAddress,ULONG ulTargetSize,ULONG ulFlieAlignPatchCodeSize,ULONG ulRealPatchCodeSize,ULONG ulNewOEP)
{
    PIMAGE_DOS_HEADER DosHead         = (PIMAGE_DOS_HEADER)FileBaseAddress;
    PIMAGE_NT_HEADERS NTHead          = (PIMAGE_NT_HEADERS)((ULONG_PTR)DosHead+DosHead->e_lfanew);
    PIMAGE_SECTION_HEADER SectionHead = (PIMAGE_SECTION_HEADER)((ULONG_PTR)NTHead+sizeof(IMAGE_NT_HEADERS));
    
    ULONG MemoryAlignment   = NTHead->OptionalHeader.SectionAlignment; 
    ULONG ulNumberOfSection = NTHead->FileHeader.NumberOfSections;

    SectionHead[ulNumberOfSection-1].Characteristics   = 0x60000020;
    SectionHead[ulNumberOfSection-1].Misc.VirtualSize  = SectionHead[ulNumberOfSection-1].SizeOfRawData + ulRealPatchCodeSize;   
    SectionHead[ulNumberOfSection-1].SizeOfRawData    += ulFlieAlignPatchCodeSize;
    

    NTHead->OptionalHeader.SizeOfImage =  Align(SectionHead[ulNumberOfSection-1].VirtualAddress+SectionHead[ulNumberOfSection-1].SizeOfRawData,MemoryAlignment);
    NTHead->OptionalHeader.AddressOfEntryPoint = ulNewOEP;
}



ULONG Align(ULONG FileSize,ULONG ulAlignment)
{
    if(FileSize%ulAlignment != 0)
    {
        int Temp = FileSize/ulAlignment;
        return ulAlignment*(Temp+1);
    }
    else
    {
        return FileSize;
    }
}
DWORD GetFileInfo(PVOID FileBaseAddress,PATCH_FILE_INFO Type)
{
    PIMAGE_DOS_HEADER DosHead = (PIMAGE_DOS_HEADER)FileBaseAddress;
    PIMAGE_NT_HEADERS NTHead  = (PIMAGE_NT_HEADERS)((ULONG_PTR)DosHead+DosHead->e_lfanew);
    PIMAGE_SECTION_HEADER SectionHead = (PIMAGE_SECTION_HEADER)((ULONG_PTR)NTHead+sizeof(IMAGE_NT_HEADERS));

    DWORD dwEntryPoint = NTHead->OptionalHeader.AddressOfEntryPoint;
    DWORD dwRet = 0;
    if(Type == AddressOfEntryPoint)
    {
        dwRet = dwEntryPoint;
    }
    if(Type == FileAlignment)
    {
        dwRet = NTHead->OptionalHeader.FileAlignment;
    }
    
    for(int i=0;i<NTHead->FileHeader.NumberOfSections;i++)
    {
        if(dwEntryPoint>=SectionHead[i].VirtualAddress && dwEntryPoint<SectionHead[i].VirtualAddress+SectionHead[i].SizeOfRawData)
        {

            if(Type == RealSectionSize)
            {
                dwRet = SectionHead[i].Misc.VirtualSize;
            }
            if(Type == SectionRVA)
            {
                dwRet = SectionHead[i].PointerToRawData;
            }                    
                        
        }    
        
    }

    if(dwRet == NULL)
    {
        printf("GetFileInfo Failed！
");
    }

    return dwRet;

}

PVOID GetFileBaseAddressAndSize(char* szFilePath,PULONG ulFileSize )
{
    HANDLE hFile = CreateFileA(szFilePath,
        GENERIC_READ|GENERIC_WRITE,FILE_SHARE_WRITE|FILE_SHARE_WRITE,NULL,
        OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);

    if (hFile==INVALID_HANDLE_VALUE)
    {
        printf("CreateFile Failed！
");
        return NULL;
    }
    *ulFileSize  = GetFileSize(hFile,NULL);

    if (!(*ulFileSize))
    {
        printf("GetFileSize Failed！
");
        CloseHandle(hFile);
        return NULL;
    }
    HANDLE hMapFile = CreateFileMapping(
        hFile,
        NULL,
        PAGE_READWRITE, 
        0,
        0,              
        NULL);

    if (hMapFile == INVALID_HANDLE_VALUE)
    {
        printf("CreateFileMapping Failed！
");
        CloseHandle(hFile);
        return NULL;
    }

    PVOID FileBaseAddress = MapViewOfFile(hMapFile,FILE_MAP_ALL_ACCESS,NULL,NULL,NULL);
    if (FileBaseAddress == NULL)
    {
        CloseHandle(hFile);
        CloseHandle(hMapFile);
        printf("MapViewOfFile Failed！
");
        return NULL;
    }

    return FileBaseAddress;
}