zoukankan      html  css  js  c++  java
  • PE 合并节

    前言:这将近半年准备大三专升本考试,在前几天终于考完了,不管好还是坏,等下个月初出成绩吧,自己现在就开始先复习知识点先

    先开始复习的是PE,在PE的学习中忘记了写PE的合并节,所以这里重新写下

    void MerageSection(PVOID pFileBuffer,PDWORD OldBufferSize,PVOID* pNewBuffer){
    	
    	PIMAGE_DOS_HEADER pImageDosHeader = NULL;
    	PIMAGE_FILE_HEADER pImageFileHeader = NULL;
    	PIMAGE_OPTIONAL_HEADER32 pImageOptionalHeader = NULL;
    	PIMAGE_SECTION_HEADER pImageSectionHeaderGroup = NULL;
    	PIMAGE_SECTION_HEADER NewSec = NULL;
    
    	DWORD dwSectionAlignmentSizeOfHeaders = 0;
    	DWORD dwMaxSizeOfRawDataOrVirtualSize = 0;
    	int i = 0;
    
    	*pNewBuffer = (PVOID)malloc(*OldBufferSize);
    	memset(*pNewBuffer, *OldBufferSize, 0);
    	memcpy(*pNewBuffer, pFileBuffer, *OldBufferSize);
    
    	pImageDosHeader = (PIMAGE_DOS_HEADER)*pNewBuffer;
    	pImageFileHeader = (PIMAGE_FILE_HEADER)((DWORD)pImageDosHeader + pImageDosHeader->e_lfanew + 4);
    	pImageOptionalHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pImageFileHeader + sizeof(IMAGE_FILE_HEADER));
    	pImageSectionHeaderGroup = (PIMAGE_SECTION_HEADER)((DWORD)pImageOptionalHeader + pImageFileHeader->SizeOfOptionalHeader);
    
    	/*	
    		1、拉伸到内存						
    
    		2、将第一个节的内存大小、文件大小改成一样						
    
    		Max = SizeOfRawData>VirtualSize?SizeOfRawData:VirtualSize						
    
    		SizeOfRawData = VirtualSize = 最后一个节的VirtualAddress + Max - SizeOfHeaders内存对齐后的大小						
    
    		3、将第一个节的属性改为包含所有节的属性						
    
    		4、修改节的数量为1						
    	*/
    
    	dwSectionAlignmentSizeOfHeaders = ((pImageOptionalHeader->SizeOfHeaders%pImageOptionalHeader->SectionAlignment)+1)*pImageOptionalHeader->SectionAlignment;
    
    	dwMaxSizeOfRawDataOrVirtualSize = pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].SizeOfRawData
    		> pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].Misc.VirtualSize
    		? pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].SizeOfRawData
    		: pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].Misc.VirtualSize;
    
    	printf("%x
    ", dwMaxSizeOfRawDataOrVirtualSize);
    	
    	printf("%x
    ", pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].VirtualAddress 
    		+ dwMaxSizeOfRawDataOrVirtualSize - dwSectionAlignmentSizeOfHeaders);
    
    	pImageSectionHeaderGroup[0].SizeOfRawData = pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].VirtualAddress 
    		+ dwMaxSizeOfRawDataOrVirtualSize - dwSectionAlignmentSizeOfHeaders;
    
    	pImageSectionHeaderGroup[0].Misc.VirtualSize = pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].VirtualAddress
    		+ dwMaxSizeOfRawDataOrVirtualSize - dwSectionAlignmentSizeOfHeaders;
    
    	for(i=1;i<pImageFileHeader->NumberOfSections;i++){
    		pImageSectionHeaderGroup[0].Characteristics |= pImageSectionHeaderGroup[i].Characteristics;
    	}
    
    	pImageFileHeader->NumberOfSections = 1;
    
    }
    
    

  • 相关阅读:
    敏捷个人手机应用:如何下载敏捷个人资料
    2014年8月10日:敏捷个人奥森跑步+慢走分享
    敏捷个人手机应用:如何进行敏捷个人练习
    敏捷个人新体系:定位
    任何社区,只要能影响他人成长的人,都可以成为敏捷个人的荣誉会员
    亲密爱人:《亲密关系》读书笔记
    亲密爱人:《亲密关系
    2014.7.12 敏捷个人奥森健步走&敏友分享会.活动报道
    开放产品开发(OPD):产品负责人的工作原则和方法
    #敏捷个人资料# 免费下载 《敏捷个人-认识自我,管理自我 v0.8.pdf》
  • 原文地址:https://www.cnblogs.com/zpchcbd/p/14674146.html
Copyright © 2011-2022 走看看