zoukankan      html  css  js  c++  java
  • PE 合并节

    前言:这将近半年准备大三专升本考试,在前几天终于考完了,不管好还是坏,等下个月初出成绩吧,自己现在就开始先复习知识点先

    先开始复习的是PE,在PE的学习中忘记了写PE的合并节,所以这里重新写下

    void MerageSection(PVOID pFileBuffer,PDWORD OldBufferSize,PVOID* pNewBuffer){
    	
    	PIMAGE_DOS_HEADER pImageDosHeader = NULL;
    	PIMAGE_FILE_HEADER pImageFileHeader = NULL;
    	PIMAGE_OPTIONAL_HEADER32 pImageOptionalHeader = NULL;
    	PIMAGE_SECTION_HEADER pImageSectionHeaderGroup = NULL;
    	PIMAGE_SECTION_HEADER NewSec = NULL;
    
    	DWORD dwSectionAlignmentSizeOfHeaders = 0;
    	DWORD dwMaxSizeOfRawDataOrVirtualSize = 0;
    	int i = 0;
    
    	*pNewBuffer = (PVOID)malloc(*OldBufferSize);
    	memset(*pNewBuffer, *OldBufferSize, 0);
    	memcpy(*pNewBuffer, pFileBuffer, *OldBufferSize);
    
    	pImageDosHeader = (PIMAGE_DOS_HEADER)*pNewBuffer;
    	pImageFileHeader = (PIMAGE_FILE_HEADER)((DWORD)pImageDosHeader + pImageDosHeader->e_lfanew + 4);
    	pImageOptionalHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pImageFileHeader + sizeof(IMAGE_FILE_HEADER));
    	pImageSectionHeaderGroup = (PIMAGE_SECTION_HEADER)((DWORD)pImageOptionalHeader + pImageFileHeader->SizeOfOptionalHeader);
    
    	/*	
    		1、拉伸到内存						
    
    		2、将第一个节的内存大小、文件大小改成一样						
    
    		Max = SizeOfRawData>VirtualSize?SizeOfRawData:VirtualSize						
    
    		SizeOfRawData = VirtualSize = 最后一个节的VirtualAddress + Max - SizeOfHeaders内存对齐后的大小						
    
    		3、将第一个节的属性改为包含所有节的属性						
    
    		4、修改节的数量为1						
    	*/
    
    	dwSectionAlignmentSizeOfHeaders = ((pImageOptionalHeader->SizeOfHeaders%pImageOptionalHeader->SectionAlignment)+1)*pImageOptionalHeader->SectionAlignment;
    
    	dwMaxSizeOfRawDataOrVirtualSize = pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].SizeOfRawData
    		> pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].Misc.VirtualSize
    		? pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].SizeOfRawData
    		: pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].Misc.VirtualSize;
    
    	printf("%x
    ", dwMaxSizeOfRawDataOrVirtualSize);
    	
    	printf("%x
    ", pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].VirtualAddress 
    		+ dwMaxSizeOfRawDataOrVirtualSize - dwSectionAlignmentSizeOfHeaders);
    
    	pImageSectionHeaderGroup[0].SizeOfRawData = pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].VirtualAddress 
    		+ dwMaxSizeOfRawDataOrVirtualSize - dwSectionAlignmentSizeOfHeaders;
    
    	pImageSectionHeaderGroup[0].Misc.VirtualSize = pImageSectionHeaderGroup[pImageFileHeader->NumberOfSections-1].VirtualAddress
    		+ dwMaxSizeOfRawDataOrVirtualSize - dwSectionAlignmentSizeOfHeaders;
    
    	for(i=1;i<pImageFileHeader->NumberOfSections;i++){
    		pImageSectionHeaderGroup[0].Characteristics |= pImageSectionHeaderGroup[i].Characteristics;
    	}
    
    	pImageFileHeader->NumberOfSections = 1;
    
    }
    
    

  • 相关阅读:
    项目笔记:统计页面功能实现
    jquery easyui datagrid实现数据改动
    Skia图片解码模块流程分析
    TRIZ的成功案例
    基于HTML5的Web SCADA工控移动应用
    webservices系列(五)——javaweb整合Axis2及多service配置
    org.hibernate.PropertyValueException: not-null property references a null or transient value: model.
    线程池和异步线程
    [leetcode]Implement strStr()
    Python工作日类库Busines Holiday介绍
  • 原文地址:https://www.cnblogs.com/zpchcbd/p/14674146.html
Copyright © 2011-2022 走看看