zoukankan      html  css  js  c++  java

  • 010 editor手写pe文件

    原则：严谨细节

    【文章标题】: 010 editor手写pe文件
    【文章作者】: Clark
    【作者邮箱】: lost_poet@foxmail.com
    【作者QQ号】: 515996958
    【软件名称】:弹窗Hello World! 
    【软件大小】: 3K 
    【使用工具】: 010 editor
    【操作平台】: Win10 x64
     
    【声明：复习PE文件结构】
    PE文件的结构的重要性毋庸置疑，在软件逆向，漏洞分析，以及病毒分析中均至关重要，所以PE文件的结构必须不能忘，计划隔一段就自己手写一个PE程序以温故知新

    正题：

    PE文件结构;(Portable Executable（可移植的执行体）)：
    --------------------------------------
    DOS头部
    (IMAGE_DOS_HEADER)    		 DOS HEADER DosHeader 64byte(40h) 为兼容DOS程序而立
    DOS 头使用的数据（此段不重要） DOS STUB DosStub 大小取决于DOS头的最后一个元素
    因为e_lfanew记录的NT 头的偏移的位置    		 （可以将PE头部放在这里，甚至使DOS头与PE头重合
    NT头
    (IMAGE_NT_HEADER32)    		 NT HEADRS NtHeader DWORD Signature                             标记，4byte
    IMAGE_FILE_HEADER FileHeader  文件头，20byte
    IMAGE_OPTIONAL_HEADER32 OPtionlHeader 扩展头,32位00E0，64位00F0    		 存储PE文件的全部属性，初始化信息等(包含，文件头，扩展头）
    区段头表(结构体数组）
    (IMAGE_SECTION_HEADER)    		 SECTION HEADER SectionHeader 每个区段头40byte 对于PE文件主体属性的分段描述，个数不定
    各个区段（常见的区段） .text                   一般是代码段
    .data                  一般是数据段
    .bss             表示未初始化的数据，像static变量
    .rdata                  表示只读的数据，比如字符串
    .textbss               和代码有关，暂不清楚作用
    .idata和edata      存储导入表导出表的信息
    .rsrc                    存储资源的区段
    .relcoc                存储重定位的区段    		 个数不定，
    大小视程序决定，
    我们自己写的简单的helloworld，三个区段，各200byte 足够了    		 PE文件的主体，分段存储着可执行的代码，各种数据，资源等
    一些调试信息 暂时不表述 暂时不表述 暂时不表述
     
     所有的PE文件（exe,dll)必须以DOS头开始；
     
    //DOS头---需要设置的有两个元素
typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
    WORD   e_magic;                     // Magic number（魔数，值恒为4D5A)
    WORD   e_cblp;                      // Bytes on last page of file
    WORD   e_cp;                        // Pages in file
    WORD   e_crlc;                      // Relocations
    WORD   e_cparhdr;                   // Size of header in paragraphs
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
    WORD   e_ss;                        // Initial (relative) SS value
    WORD   e_sp;                        // Initial SP value
    WORD   e_csum;                      // Checksum
    WORD   e_ip;                        // Initial IP value
    WORD   e_cs;                        // Initial (relative) CS value
    WORD   e_lfarlc;                    // File address of relocation table
    WORD   e_ovno;                      // Overlay number
    WORD   e_res[4];                    // Reserved words
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
    WORD   e_res2[10];                  // Reserved words
    LONG   e_lfanew;                    // File address of new exe header(NT 头的偏移）可以自己填写
  } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
    //NT头--都很重要，文件头跟扩展头需要细说
typedef struct _IMAGE_NT_HEADERS {
    DWORD Signature;                           //标记，判断是否是PE文件的第二个标志，恒为0x00004550，ASCII为“PE00”
    IMAGE_FILE_HEADER FileHeader;              //文件头
    IMAGE_OPTIONAL_HEADER32 OptionalHeader;    //扩展头 
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
    //文件头---共20个字节
typedef struct _IMAGE_FILE_HEADER {
    WORD    Machine;                                1，文件的运行CPU平台-------0x014c,i386,,0x0200代表64位平台
    WORD    NumberOfSections;                       2，区段的数量-------------我们这个程序写成3个区段
    DWORD   TimeDateStamp;                          3，文件的创建时间---------不太重要，0x00000000
    DWORD   PointerToSymbolTable;                   4，符号表偏移------------对程序执行无影响，0x00000000
    DWORD   NumberOfSymbols;                        5，符号个数--------------对程序执行无影响，0x00000000
    WORD    SizeOfOptionalHeader;                   6，扩展头大小------------扩展头大小一般32位是00E0,64位是00F0
    WORD    Characteristics;                        7，PE文件的一些属性------dll一般是0x0210,exe是0x010F
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
    //扩展头31个成员--扩展头大小一般32位是00E0,64位是00F0
typedef struct _IMAGE_OPTIONAL_HEADER {
    WORD    Magic;                                                                         1,标志PE文件的类型，32位一般是0X010B，64位是0x020B,0X0107表示ROM映像
    BYTE    MajorLinkerVersion;                                                            2，链接器主板本号，可以0x00000000
    BYTE    MinorLinkerVersion;                                                            3，链接器此版本号，可以0x00000000
    DWORD   SizeOfCode;                                                                    4，代码区段的大小，不影响执行，可以0x00000000
    DWORD   SizeOfInitializedData,                                                         5，已初始化数据的大小，不影响执行，可以0x00000000
    DWORD   SizeOfUninitializedData;                                                       6，未初始化数据的大小，不影响执行，可以0x00000000
    DWORD   AddressOfEntryPoint;                                                           7，程序执行入口RVA，OEP，一般.text段是代码段，所以这个值是.text段的首地址，但是应该是内存对齐后的
                                                                                              而我们整个pe头在内存中对齐后也就能占用1000，所以这个值是1000
    DWORD   BaseOfCode;                                                                    8，起始代码的RVA，不影响执行，可以0x00000000
    DWORD   BaseOfData;                                                                    9，起始数据的RVA，不影响执行，可以0x00000000
    // NT additional fields.                                                         
    DWORD   ImageBase;                                                                     10，默认加载基址：如果没有加载到这个基址，会发生重定位，必须是64K的倍数，DLL是0x100 0000--- PE装载器将尝试把文件装到虚拟地址空间的0040 0000h处。                                                                                                          字眼"优先"表 示若该地址区域已被其他模块占用，那PE装载器会  选用其他空闲地址。我们这里的值设为“00400000”。
    DWORD   SectionAlignment;                                                              11，块对齐单位---一般是0X1000
    DWORD   FileAlignment;                                                                 12，文件对齐单位-一般是0X200
    WORD    MajorOperatingSystemVersion;                                                   13，主操作系统版本号，可以0x00000000
    WORD    MinorOperatingSystemVersion;                                                   14，次操作系统版本号，可以0x00000000
    WORD    MajorImageVersion;                                                             15，主映像版本，可以0x00000000
    WORD    MinorImageVersion;                                                             16，次映像版本，可以0x00000000
    WORD    MajorSubsystemVersion;                                                         17，主子系统版本，可以0x00000000
    WORD    MinorSubsystemVersion;                                                         18，次子系统版本，win32子系统版本。PE文件是专门为Win32设计的，该子系统版本必定是4.0那么此处值为“04”。
    DWORD   Win32VersionValue;                                                             19，保留值，，可以0x00000000
    DWORD   SizeOfImage;                                                                   20，映像大小，要把文件加载进内存需要的总大小，内存对齐后的--文件PE结构总长小于1000h，但是内存中的对齐粒度是1000h，所以PE结构被映射后要占1000h，
                                                                                              尽管很多空间没有使用，另外我们有3个段，每个段的长度小于1000h，但是被映射后同样要占1000h，
                                                                                              所以总共占用内存的大  小为1000h + 3* 1000h = 4000h，因此此值为“00400000”。
    DWORD   SizeOfHeaders;                                                                 21，所有头部大小，也是文件主体相对文件偏移的位置，文件对齐后的，
                                                                                                DOS头+sub+文件头中的Signature+NT头+扩展头+3个区段头；
                                                                                                64   +80 +  4               + 20 +  224 +  3*40   =  512  =  200h,以200h对齐后，实际为200h的空间，0x00020000
    DWORD   CheckSum;                                                                      22，校验和，可以0x00000000
    WORD    Subsystem;                                                                     23，子系统平台，在windows中的合法值只能是2或者3，2是GUI，表示无控制台，3是CUI，表示带控制台
    WORD    DllCharacteristics;                                                            24，指示Dll特征的标志，可以0x00000000
    DWORD   SizeOfStackReserve;                                                            25，进程中栈一般可以增长到的最大值，一般是1MB，可以0x00000000
    DWORD   SizeOfStackCommit;                                                             26，栈的初始值，每次分配增长的值，一般是4kb，填为0x04000000
    DWORD   SizeOfHeapReserve;                                                             27，堆可以增长到的最大值，一般是1mb，可以0x00000000
    DWORD   SizeOfHeapCommit;                                                              28，进程堆的初始值，可以0x00000000
    DWORD   LoaderFlags;                                                                   29，无用，可以0x00000000
    DWORD   NumberOfRvaAndSizes;                                                           30，数据目录表的个数，也就是下面那个数组的元素个数，，按照正常的PE格式此处应该为0x10,可改动，需重新研究位置
    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];                  31，数据目录表，
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

    //区段头表--每一个区段头表中都是以下这个结构体--40个字节
typedef struct _IMAGE_SECTION_HEADER { 
BYTE Name[IMAGE_SIZEOF_SHORT_NAME];     1，区段的名字，只是一些约定俗称的名称
union { 
DWORD PhysicalAddress;                
DWORD VirtualSize; 
} Misc;                                  2，这个区段的大小，pe程序对此值的效验并没有那么严谨，但是最好与SizeOfRawData的值一致
DWORD VirtualAddress;                    3，区段的起始相对虚拟地址RVA，，比如我们.text是第一个区段，之前的所有文件大小对齐后占用的空间为1000h,那么这个值便是1000h，第二个区段的这个值是2000h
DWORD SizeOfRawData;                     4，区段在文件中的大小，是对齐后的，我们的代码较少，则这个值便是200h
DWORD PointerToRawData;                  5，区段的文件偏移，，，我们上面计算的PE文件头的大小刚好是200h，那么这个值便是200h，，后面的每个区段的这个值是，当前区段的SizeOfRawData+前一个区段的PointerToRawData
DWORD PointerToRelocations;              6，区段的重定位的信息的文件偏移，早OBJ文件中可用
DWORD PointerToLinenumbers;              7，没用
WORD NumberOfRelocations;                8，没用
WORD NumberOfLinenumbers;                9，没用
DWORD Characteristics;                  10，重要，这个区段的属性,(如代码/数据/可读/可写)的标志
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

PE文件识别区段靠的不是区段的名字，是区段的属性
//比较重要的区段属性值
IAMGE_SCN_CNT_CODE                           0x20h            包含代码,常与10000000h 一起设置
IMAGE_SCN_CNT_INITIALIZED_DATA               0x40h            该块包含已初始化的数据
IMAGE_SCN_CNT_UNINITIALIZED_DATA             0x80h            该块包含未初始化的数据
IAMGE_SCN_MEM_DISCARDABLE              0x02000000h            该块可被丢弃，一旦加载可被丢弃的块.reloc(重定位块)
IAMGE_SCN_MEM_SHARED                   0x10000000h            该块为共享块
IAMGE_SCN_MEM_EXECUTE                  0x20000000h            该块可执行通常与0x20标志一起被设置
IAMGE_SCN_MEM_READ                     0x40000000h            该块可读
IAMGE_SCN_MEM_WRITE                    0x80000000h            该块可写


常用区段设置的值：
.text              0x6000 0020 内存中 20 00 00 60
.textbss           0xE000 00A0 内存中 A0 00 00 E0
.data              0xC000 0040 内存中 40 00 00 C0
.rdata             0x4000 0040 内存中 40 00 00 40
.idata             0x4000 0040 内存中 40 00 00 40
.rerc              0x4000 0040 内存中 40 00 00 40
    以上填写完毕后代码如下：
4D 5A 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
50 45 00 00 4C 01 03 00 00 00 00 00 00 00 00 00
00 00 00 00 E0 00 0F 01 0B 01 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00
00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00
00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
00 40 00 00 00 02 00 00 00 00 00 00 03 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00
10 20 00 00 3C 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 2E 74 65 78 74 00 00 00
00 02 00 00 00 10 00 00 00 02 00 00 00 02 00 00
00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60
2E 72 64 61 74 61 00 00 00 02 00 00 00 20 00 00
00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00
00 00 00 00 40 00 00 40 2E 64 61 74 61 00 00 00
00 02 00 00 00 30 00 00 00 02 00 00 00 06 00 00
00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0
    以上我们已经完全解析了文件头部的问题，还有个问题就是数据目录表的结构：
    我们这个手写程序只需要用到导入表，所以我门只需要解析导入表即可，其余全部置零即可
    导入表是数据目录表的第二项，当前我们暂时把它也置零 ，后面我们把.rdata段写好，来填写这两个值
      
    每个数据目录表的结构：
typedef struct _IMAGE_DATA_DIRECTORY { 
DWORD VirtualAddress;        数据的相对虚拟地址 
DWORD Size;                  数据的大小
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;

数据目录表的16个成员
IMAGE_DIRECTORY_ENTRY_EXPORT            (0)导出表  
IMAGE_DIRECTORY_ENTRY_IMPORT            (1)导入表    
IMAGE_DIRECTORY_ENTRY_RESOURCE          (2)资源表    
IMAGE_DIRECTORY_ENTRY_EXCEPTION         (3)异常表    
IMAGE_DIRECTORY_ENTRY_SECURITY          (4)安全目录    
IMAGE_DIRECTORY_ENTRY_BASERELOC         (5)重定位表    
IMAGE_DIRECTORY_ENTRY_DEBUG             (6)调试目录
IMAGE_DIRECTORY_ENTRY_COPYRIGHT         (7)描述版权串    
IMAGE_DIRECTORY_ENTRY_GLOBALPTR         (8)机器值    
IMAGE_DIRECTORY_ENTRY_TLS               (9)指向线程局部存储（Thread local storage）初始化节
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG       (10)载入配置表    
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT      (11)绑定输入目录    
IMAGE_DIRECTORY_ENTRY_IAT               (12)导入地址表目录
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT      (13)延迟载入描述
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR    (14)COM信息

    导出表(此程序用不到，仅供复习）；

    //导出表结构---40字节
typedef struct _IMAGE_EXPORT_DIRECTORY {
    DWORD   Characteristics;                //1，没用，保留值，长为0
    DWORD   TimeDateStamp;                  //2，没用，和文件头中的时间一样的
    WORD    MajorVersion;                   //3，没用，主板本号
    WORD    MinorVersion;                   //4，没用，次版本号
    DWORD   Name;                           //5，有用，本PE文件的名字，也就是谁导出的这些函数（变量，类）
    DWORD   Base;                           //6，有用，序号基数
    DWORD   NumberOfFunctions;              //7，重要，函数数量
    DWORD   NumberOfNames;                  //8，函数名称数量
    DWORD   AddressOfFunctions;             //9，重要，函数地址表的相对虚拟地址// RVA from base of image
    DWORD   AddressOfNames;                 //10，重要，函数名称表的相对虚拟地址/// RVA from base of image
    DWORD   AddressOfNameOrdinals;          //11，重要，函数序号表的相对虚拟地址/// RVA from base of image
} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;

    下面解析导入表：

    //导入表结构---20字节
如果程序从10个不同的dll中导入函数，那么这个数组就有10个成员，该数组以一个全0的成员结尾
typedef struct _IMAGE_IMPORT_DESCRIPTOR {
    union {
        DWORD   Characteristics;            // 
        DWORD   OriginalFirstThunk;         //1，重要，指向一个结构体数组的相对虚拟地址，RVA，结构体数组名叫做INT，（import Name table)
    } DUMMYUNIONNAME;                    
    DWORD   TimeDateStamp;                  //2，（没用）   
    DWORD   ForwarderChain;                 //3，转发机制用，这里用不到       
    DWORD   Name;                           //4，导入的PE文件的名字
    DWORD   FirstThunk;                     //5，指向一个结构体数组的相对虚拟地址，RVA，结构体数组叫做IAT，（Import Address Table)
} IMAGE_IMPORT_DESCRIPTOR;

1，第一个元素OriginalFirstThunk与第五个元素FirstThunk指向的是相同的结构体 IMAGE_THUNK_DATA；
2，在磁盘文件中，OriginalFirstThunk 与 FirstThunk中的数据是相同的，可以将输入名称表INT看做是输入地址表IAT的一个备份，
但是在加载到内存中的时候，输入地址表会 由加载器把相应的PE文件的函数地址 覆盖到这里来，这时候 IAT才是真正的IAT
--INT是原始的，加载到内存中的时候，就是IAT了

3，在有些文件中，输入名称表是空的，全零，什么都没有。这说明输入地址表有时候没有备份。所以解析输入表的时候最好使用输入地址表来解析，也可以两个分别查看
4，指向的结构体以全零为结尾，可以作为解析时的结束条件

//这是指向的那个结构体 32位下
//可以看到是一个联合体，共4字节，但是不要忘记每一个这个结构体后面都需要一个全零的结构体来作为结尾
typedef struct _IMAGE_THUNK_DATA32 {
    union {
        DWORD ForwarderString;      // 转发才用到
        DWORD Function;             // 导入函数的地址，在加载到内存后，这里才起作用
        DWORD Ordinal;              // 假如是序号导入到的，用到这里
        DWORD AddressOfData;        // 假如是函数名称导入的，用这里，它指向一个PIMAGE_IMPORT_BY_NAME的结构体
    } u1;
} IMAGE_THUNK_DATA32;
//1,在磁盘文件中，起作用的只有后面两个成员
//2，这个结构占4个字节，假如最高位是1，那么序号导入起作用，只需输出一个序号，
//                    假如最高位是0，那么是最后一个成员起作用，指向一个_IMAGE_IMPORT_BY_NAME
//下面这个包含了序号和函数名
typedef struct _IMAGE_IMPORT_BY_NAME {
    WORD    Hint;
    CHAR   Name[1];
} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;

     

    那么OK，我们的.rdata段的导入表解析完成了，然后我们之前在数据目录表的导入表的位置空置着的两个值也可以填入了， VirtualAddress是2010h(在内存对齐后的），Size是三个结构体的大小是60==3Ch
    整个.rdata段的代码
      
    76 20 00 00 00 00 00 00 5C 20 00 00 00 00 00 00
4C 20 00 00 00 00 00 00 00 00 00 00 6A 20 00 00
08 20 00 00 54 20 00 00 00 00 00 00 00 00 00 00
84 20 00 00 00 20 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 5C 20 00 00
00 00 00 00 76 20 00 00 00 00 00 00 00 00 4D 65
73 73 61 67 65 42 6F 78 41 00 75 73 65 72 33 32
2E 64 6C 6C 00 00 00 00 45 78 69 74 50 72 6F 63
65 73 73 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

    .Text 段

    我们暂时在OD，或者x64DBG 里面写下如下的汇编指令;
      
    push 0;
push 0;
push 0;
push 0;
call [00402008];//导入表内MessageBoxA地址
push 0;
call [00402000];//导入表内ExitProcess的地址

得到的OPCode代码为：
6A 00 6A 00 6A 00 6A 00 FF 15 08 20 40 00 6A 00
FF 15 00 20 40 00
粘贴到010里面；
即：
6A 00 6A 00 6A 00 6A 00 FF 15 08 20 40 00 6A 00
FF 15 00 20 40 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

    程序完成!

    我们的helloworld 还没有弹出来呢，那就很简单了:
    .data段
      
    把字符串“消息框”“helloworld”转换成opcode;
CF FB CF A2 BF F2 00 48 65 6C 6C 6F 2C 20 57 6F
72 6C 64 20 21 00
粘贴到.data段
然后修改.text段的push的时候的地址即可；
push 0的时候的OPCode：
6A 00 6A 00 6A 00 6A 00 FF 15 08 20 40 00 6A 00
FF 15 00 20 40 00
修改为我们push 字符串地址--》即 ：
push 0;
push 00403000;
pusn 00403008;
push 0;
call [00402008];//导入表内MessageBoxA地址
push 0;
call [00402000];//导入表内ExitProcess的地址
即：
6A 00 68 00 30 40 00 68 07 30 40 00 6A 00 FF 15
08 20 40 00 6A 00 FF 15 00 20 40 00
以上，即可；

     修正后：

    6A 00 68 00 30 40 00 68 07 30 40 00 6A 00 FF 15
08 20 40 00 6A 00 FF 15 00 20 40 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
76 20 00 00 00 00 00 00 5C 20 00 00 00 00 00 00
4C 20 00 00 00 00 00 00 00 00 00 00 6A 20 00 00
08 20 00 00 54 20 00 00 00 00 00 00 00 00 00 00
84 20 00 00 00 20 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 5C 20 00 00
00 00 00 00 76 20 00 00 00 00 00 00 00 00 4D 65
73 73 61 67 65 42 6F 78 41 00 75 73 65 72 33 32
2E 64 6C 6C 00 00 00 00 45 78 69 74 50 72 6F 63
65 73 73 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CF FB CF A2 BF F2 00 48 65 6C 6C 6F 2C 20 57 6F
72 6C 64 20 21 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

     

     完成
  • 相关阅读:
    写了个日常开发常用的对话框（模拟alert，confirm....）
    javascrit事件绑定，删除方法(解决IE现代事件绑定方法的一些缺陷).
    常见的焦点图旋转效果
    js性能优化的一些常识
    配合鼠标滚轮事件的可自定义样式的区域滚动条插件（基于jquery）
    基于Jquery的放大镜（模仿淘宝的不同尺寸图片查看）
    华为与H3C（华三）的前世今生
    竞品分析
    postman 学习记录
    单元化架构
  • 原文地址：https://www.cnblogs.com/by-clark/p/9129135.html
Copyright © 2011-2022 走看看