PE

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
    WORD   e_magic;                     // Magic number  DOS头的标识，为4Dh和5Ah。分别为字母MZ
    WORD   e_cblp;                      // Bytes on last page of file
    WORD   e_cp;                        // Pages in file
    WORD   e_crlc;                      // Relocations
    WORD   e_cparhdr;                   // Size of header in paragraphs
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
    WORD   e_ss;                        // Initial (relative) SS value
    WORD   e_sp;                        // Initial SP value
    WORD   e_csum;                      // Checksum
    WORD   e_ip;                        // Initial IP value
    WORD   e_cs;                        // Initial (relative) CS value
    WORD   e_lfarlc;                    // File address of relocation table
    WORD   e_ovno;                      // Overlay number
    WORD   e_res[4];                    // Reserved words
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
    WORD   e_res2[10];                  // Reserved words
    LONG   e_lfanew;                    // File address of new exe header   指向IMAGE_NT_HEADERS的所在(PE头相对于文件的偏移，用于定位PE文件)
  } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

0x00 WORD e_magic;      //5A4D * MZ标记用于判断是否为可执行文件
0x02 WORD e_cblp;       //0090
0x04 WORD e_cp;         //0003
0x06 WORD e_crlc;       //0000
0x08 WORD e_cparhdr;    //0004
0x0a WORD e_minalloc;   //0000
0x0c WORD e_maxalloc;   //FFFF
0x0e WORD e_ss;         //0000
0x10 WORD e_sp;         //00B8
0x12 WORD e_csum;       //0000
0x14 WORD e_ip;         //0000
0x16 WORD e_cs;         //0000
0x18 WORD e_lfarlc;     //0040
0x1a WORD e_ovno;       //0000
0x1c WORD e_res[4];     //0000000000000000
0x24 WORD e_oemid;      //0000
0x26 WORD e_oeminfo;    //0000
0x28 WORD e_res2[10];   //20
0x3c DWORD e_lfanew;    //00000080 * PE头相对于文件的偏移，用于定位PE文件

1
2
3
4
5

typedef struct IMAGE_NT_HEADERS{
0x00      DWORD Signature;                         //PE标识
0x04      IMAGE_FILE_HEADER FileHeader;            //标准PE头(20字节)
0x18      IMAGE_OPTIONAL_HEADER32 OptionalHeader;  //扩展PE头(大小不确定)
}IMAGE_NT_HEADERS,*PIMAGE_NT_HEADERS;

1
2
3
4
5
6
7
8
9

typedef struct _IMAGE_FILE_HEADER {
0x00 WORD Machine;              //014C * 程序运行的CPU型号，0x0任何处理器/0x14C Intel 386及后续处理器
0x02 WORD NumberOfSections;     //0008 * 文件中存在的节的总数，除了头，还有几节数据，如果要新增节或者合并节就要修改这个值.
0x04 DWORD TimeDateStamp;       //3E22F0DF * 时间戳:文件的创建时间(和操作系统的创建时间无关)，编译器填写的
0x08 DWORD PointerToSymbolTable;//00000000
0x0c DWORD NumberOfSymbols;     //00000000
0x10 WORD SizeOfOptionalHeader; //00E0 * 可选PE头的大小，32位PE文件默认E0h=16*14，64位PE文件默认为F0h，大小可以自定义
0x12 WORD Characteristics;      //010E * 每个位有不同的含义，可执行文件值为10F 即0 1 2 3 8位置1
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

0x00 WORD Magic; // 说明文件类型：10B->32位下的PE文件 20B->64位下的PE文件
0x02 BYTE MajorLinkerVersion;
0x03 BYTE MinorLinkerVersion;
0x04 DWORD SizeOfCode; // 代码大小/所有代码节的和，必须是FileAlignment的整数倍 编译器填的 没用
0x08 DWORD SizeOfInitializedData; // 已初始化数据大小的和，必须是 FileAlignment的整数倍 编译器填的 没用
0x0c DWORD SizeOfUninitializedData; // 未初始化数据大小的和，必须是 FileAlignment的整数倍 编译器填的 没用
0x10 DWORD AddressOfEntryPoint; // 程序入口
0x14 DWORD BaseOfCode; // 代码开始的基址，编译器填的 没用
0x18 DWORD BaseOfData; // 数据开始的基址，编译器填的 没用
0x1c DWORD ImageBase; // 内存镜像基址
0x20 DWORD SectionAlignment; // 内存对齐，区段对齐
0x24 DWORD FileAlignment; // 文件对齐
0x28 WORD MajorOperatingSystemVersion;
0x2a WORD MinorOperatingSystemVersion;
0x2c WORD MajorImageVersion;
0x2e WORD MinorImageVersion;
0x30 WORD MajorSubsystemVersion;
0x32 WORD MinorSubsystemVersion;
0x34 DWORD Win32VersionValue;
0x38 DWORD SizeOfImage; //镜像大小/ 内存中整个PE文件的映射的尺寸，可以比实际的值大，但必须是SectionAlignment的整数倍，是拉伸之后的大小，，，
0x3c DWORD SizeOfHeaders; // 所有头+节表，技照‘文件对齐 FileAlignment’后的大小，否则加载会出错
0x40 DWORD CheckSum; // 校验和，一些系统文件有要求，用来判断文件是否被修改
0x44 WORD Subsystem;
0x46 WORD DllCharacteristics;
0x48 DWORD SizeOfStackReserve; // 初始化时保留的堆栈大小
0x4c DWORD SizeOfStackCommit; // 初始化时实际提交的大小
0x50 DWORD SizeOfHeapReserve; // 初始化时保留的堆大小
0x54 DWORD SizeOfHeapCommit; // 初始化时实践提交的大小
0x58 DWORD LoaderFlags;
0x5c DWORD NumberOfRvaAndSizes; // 目录项数目，RVA数目和大小
0x60 _IMAGE_DATA_DIRECTORY DataDirectory[16]; //16个结构体，每个结构体是8个字节

1
2
3
4

union TestUnion {	
    char x;
    int y;
};

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

#define IMAGE_SIZEOF_SHORT_NAME              8						

typedef struct _IMAGE_SECTION_HEADER {						
    BYTE    Name[IMAGE_SIZEOF_SHORT_NAME];						//8个字节 一般情况下是以"\0"结尾的ASCII码字符串来标识的名称，内容可以自定义.
    union {						
            DWORD   PhysicalAddress;						
            DWORD   VirtualSize;						
    } Misc;						                                //该节在没有对齐前的真实尺寸,该值可以不准确。
    DWORD   VirtualAddress;						                //节区在内存中的偏移地址。加上ImageBase才是在内存中的真正地址.
    DWORD   SizeOfRawData;						                //节在文件中对齐后的尺寸
    DWORD   PointerToRawData;						        	//节区在文件中的偏移
    DWORD   PointerToRelocations;						
    DWORD   PointerToLinenumbers;						
    WORD    NumberOfRelocations;						
    WORD    NumberOfLinenumbers;						
    DWORD   Characteristics;						            //节的属性  
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;						

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131

#pragma warning(disable:4996)
#include <iostream>
#include <windows.h>
#include <fstream>
#include <vector>

#define FILE_PATH "CRACKME.EXE"

void analysis_PE_head(char* File_buffer)
{
	// 实例化PE文件头几个结构体
	PIMAGE_DOS_HEADER pDosHeader = NULL;			// DOS头
	PIMAGE_NT_HEADERS pNTHeader = NULL;				// NT头
	PIMAGE_FILE_HEADER pPEHeader = NULL;			// 标准PE头
	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;	// 可选PE头
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;	// SECTION(节)头

	// PIMAGE_DOS_HEADER结构体类型转换
	pDosHeader = (PIMAGE_DOS_HEADER)File_buffer;

	// 判断是不是有效的MZ标志
	if (*((PWORD)pDosHeader) != IMAGE_DOS_SIGNATURE) {
		printf("不是有效的MZ标志!\r\n");
		return;
	}

	// 打印DOS头
	printf("=============================DOS头信息如下=============================\r\n");
	printf("MZ标志：\t\t\t0x%04X\r\n", pDosHeader->e_magic);
	printf("PE偏移：\t\t\t0x%08X\r\n", pDosHeader->e_lfanew);

	// 判断是不是有效的PE标志  =》 说明：一位16进制数占一个字节大小；在32位系统中，指针占用4字节空间，即指向的地址大小占用4字节。
	if (*((PDWORD)((DWORD)File_buffer + pDosHeader->e_lfanew)) != IMAGE_NT_SIGNATURE) {
		printf("不是有效的PE标志!\r\n");
		return;
	}

	unsigned int x = (DWORD)File_buffer;
	unsigned int x2 = (DWORD)File_buffer + pDosHeader->e_lfanew;


	// 类型转换 PIMAGE_NT_HEADERS结构体
	pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)File_buffer + pDosHeader->e_lfanew);
	// 打印NT头
	printf("=============================NT头信息如下===============================\r\n");
	printf("NT:\t\t\t\t0x%08X\r\n", pNTHeader->Signature);

	// 类型转换 PIMAGE_FILE_HEADER结构体
	pPEHeader = (PIMAGE_FILE_HEADER)((DWORD)pNTHeader + 4);
	// 打印标准PE文件头
	printf("=============================标准PE头信息如下============================\r\n");
	printf("Machine:\t\t\t0x%04X\r\n", pPEHeader->Machine);
	printf("NumberOfSections:\t\t0x%04X\n", pPEHeader->NumberOfSections);
	printf("TimeDateStamp:\t\t\t0x%08X\n", pPEHeader->TimeDateStamp);
	printf("SizeOfOptionalHeader：\t\t0x%04X\r\n", pPEHeader->SizeOfOptionalHeader);
	printf("Characteristics：\t\t0x%04X\r\n", pPEHeader->Characteristics);

	// 可选PE头的位置 = 标准PE的位置 + 标准PE头的大小(IMAGE_SIZEOF_FILE_HEADER)
	pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + IMAGE_SIZEOF_FILE_HEADER);//
	// 打印可选PE头
	printf("==============================可选PE头信息如下==============================\r\n");
	printf("Magic：\t\t\t\t0x%04X\r\n", pOptionHeader->Magic);
	printf("AddressOfEntryPoint:\t\t0x%08X\r\n", pOptionHeader->AddressOfEntryPoint);
	printf("ImageBase:\t\t\t0x%08X\r\n", pOptionHeader->ImageBase);
	printf("SectionAlignment:\t\t0x%08X\r\n", pOptionHeader->SectionAlignment);
	printf("FileAlignment:\t\t\t0x%08X\r\n", pOptionHeader->FileAlignment);
	printf("SizeOfImage:\t\t\t0x%08X\r\n", pOptionHeader->SizeOfImage);
	printf("SizeOfHeaders:\t\t\t0x%08X\r\n", pOptionHeader->SizeOfHeaders);

	// 节表的位置 = 可选PE头的位置 + 可选PE头的大小
	pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader + pPEHeader->SizeOfOptionalHeader);
	printf("==============================节表信息如下===============================\n");
	//printf("name:0x%s\n",pSectionHeader->Misc);
	DWORD dwNumberOfSection = pPEHeader->NumberOfSections;
	printf("节表的数量：%d\n", dwNumberOfSection);
	/*
	printf("0x%x\n",pPEHeader->NumberOfSections);
	printf("IMAGE_SIZEOF_SHORT_NAME:0x%x\n",IMAGE_SIZEOF_SHORT_NAME);
	printf("option_add:0x%x\n",pOptionHeader);
	printf("psection_add:0x%x\n",pSectionHeader);
	printf("==============================================================\n");*/
	for (DWORD i = 0; i < dwNumberOfSection; i++, pSectionHeader++) {
		printf("========================第%d个节信息：===============================\n", i + 1);
		printf("section_name: ");

		for (DWORD j = 0; j < IMAGE_SIZEOF_SHORT_NAME; j++) {
			printf("%c", pSectionHeader->Name[j]);
		}

		printf("\r\n");
		printf("Misc:\t\t\t\t0x%08X\r\n", pSectionHeader->Misc);
		printf("VirtualAddress:\t\t\t0x%08X\r\n", pSectionHeader->VirtualAddress);
		printf("SizeOfRawData:\t\t\t0x%08X\r\n", pSectionHeader->SizeOfRawData);
		printf("PointerToRawData:\t\t0x%08X\r\n", pSectionHeader->PointerToRawData);
		printf("Characteristics:\t\t0x%08X\r\n", pSectionHeader->Characteristics);
	}
}

void printNTHeaders()
{
	std::ifstream input(FILE_PATH, std::ios::binary);

	if (!input.is_open()) {
		std::cout << "文件打开失败" << std::endl;
	}

	// 计算文件长度
	input.seekg(0, std::ios::end);	// 设置到文件的末尾
	const int file_size = input.tellg();

	input.seekg(0, std::ios::beg);// 重新设置到文件的开始

	// 分配内存，并置零
	std::vector<char> file_buffer(file_size);
	//memset(file_buffer.data(), 0, file_size);

	// 将文件写入file_buffer中
	input.read(file_buffer.data(), file_size);

	// 打印PE头部信息
	analysis_PE_head(file_buffer.data());
}

int main(int argc, char* argv[])
{
	printNTHeaders();

	system("pause");

	return 0;
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187

#pragma warning(disable:4996)
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <windows.h>
#include <malloc.h>

#define F_PATH "CRACKME.EXE"

FILE* open_file(char* file_path, char* open_mode);
int compute_file_size(FILE* file_address);
char* allocate_buffer(int file_size);
char* readfile2memory(char* file_buffer, int file_size, FILE* file_address);
void analysis_PE_head(char* File_buffer);

VOID PrintNTHeaders()
{
	// 初始化
	//char file_path[] = "C:\\Windows\\System32\\notepad.exe";
	char file_path[] = F_PATH;
	char open_mode[] = "rb";

	// 打开文件,返回文件指针
	FILE* file_address = open_file(file_path, open_mode);

	// 计算文件长度
	int file_size = compute_file_size(file_address);

	// 分配内存，并置零
	char* File_buffer = allocate_buffer(file_size);

	// 将文件写入内存,并返回内存首地址
	File_buffer = readfile2memory(File_buffer, file_size, file_address);

	// 打印PE头部信息
	analysis_PE_head(File_buffer);

	// 释放内存、关闭文件流
	free(File_buffer);
	fclose(file_address);
}

FILE* open_file(char* file_path, char* open_mode)
{
	FILE* file_address = fopen(file_path, open_mode);  // fopen() 参数是字符串也就是常量指针类型
	if (!file_address)
	{
		printf("打开文件失败!\r\n");
		return 0;
	}
	return file_address;
}

// 计算文件的大小
int compute_file_size(FILE* file_address) {
	int size = 0;

	fseek(file_address, 0, SEEK_END);
	size = ftell(file_address);
	fseek(file_address, 0, SEEK_SET);

	return size;
}

char* allocate_buffer(int file_size) {
	char* file_buffer = (char*)malloc(file_size);

	if (!file_buffer) {
		printf("申请内存失败!\r\n");
		return 0;
	}

	memset(file_buffer, 0, file_size);

	return file_buffer;
}

char* readfile2memory(char* file_buffer, int file_size, FILE* file_address)
{
	if (!(fread(file_buffer, file_size, 1, file_address)))
	{
		printf("从文件向内存中读取数据失败!\r\n");
		return 0;
	}
	return file_buffer; // 如果写入内存成功，则返回内地址
}

void analysis_PE_head(char* File_buffer)
{
	// 实例化PE文件头几个结构体
	PIMAGE_DOS_HEADER pDosHeader = NULL;			// DOS头
	PIMAGE_NT_HEADERS pNTHeader = NULL;				// NT头
	PIMAGE_FILE_HEADER pPEHeader = NULL;			// 标准PE头
	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;	// 可选PE头
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;	// SECTION(节)头

	// 强制类型转换
	pDosHeader = (PIMAGE_DOS_HEADER)File_buffer;

	// 判断是不是有效的MZ标志
	if (*((PWORD)pDosHeader) != IMAGE_DOS_SIGNATURE)
	{
		printf("不是有效的MZ标志!\r\n");
		free(File_buffer);
		return;
	}

	// 强制类型转换 PIMAGE_DOS_HEADER结构体
	pDosHeader = (PIMAGE_DOS_HEADER)File_buffer;
	// 打印DOS头
	printf("=============================DOS头信息如下=============================\r\n");
	printf("MZ标志：\t\t\t0x%04X\r\n", pDosHeader->e_magic);
	printf("PE偏移：\t\t\t0x%08X\r\n", pDosHeader->e_lfanew);

	// 判断是不是有效的PE标志  =》 说明：一位16进制数占一个字节大小
	if (*((PDWORD)((DWORD)File_buffer + pDosHeader->e_lfanew)) != IMAGE_NT_SIGNATURE) {
		printf("不是有效的PE标志!\r\n");
		free(File_buffer);
		return;
	}

	// 强制类型转换 PIMAGE_NT_HEADERS结构体
	pNTHeader = PIMAGE_NT_HEADERS((DWORD)File_buffer + pDosHeader->e_lfanew);
	// 打印NT头
	printf("=============================NT头信息如下===============================\r\n");
	printf("NT:\t\t\t\t0x%04X\r\n", pNTHeader->Signature);
	// 强制类型转换 PIMAGE_FILE_HEADER结构体
	pPEHeader = (PIMAGE_FILE_HEADER)((DWORD)pNTHeader + 4);


	// 打印标准PE文件头
	printf("=============================标准PE头信息如下============================\r\n");
	printf("Machine:\t\t\t0x%04X\r\n", pPEHeader->Machine);
	printf("NumberOfSections:\t\t0x%04X\n", pPEHeader->NumberOfSections);
	printf("TimeDateStamp:\t\t0x%08X\n", pPEHeader->TimeDateStamp);
	printf("SizeOfOptionalHeader：\t\t0x%04X\r\n", pPEHeader->SizeOfOptionalHeader);
	printf("Characteristics：\t\t0x%04X\r\n", pPEHeader->Characteristics);

	// 可选PE头的位置 = 标准PE的位置 + 标准PE头的大小(IMAGE_SIZEOF_FILE_HEADER)
	pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + IMAGE_SIZEOF_FILE_HEADER);//
	// 打印可选PE头
	printf("==============================可选PE头信息如下==============================\r\n");
	printf("Magic：\t\t\t\t0x%04X\r\n", pOptionHeader->Magic);
	printf("AddressOfEntryPoint:\t\t0x%08X\r\n", pOptionHeader->AddressOfEntryPoint);
	printf("ImageBase:\t\t\t0x%08X\r\n", pOptionHeader->ImageBase);
	printf("SizeOfImage:\t\t\t0x%08X\r\n", pOptionHeader->SizeOfImage);
	printf("SizeOfHeaders:\t\t\t0x%08X\r\n", pOptionHeader->SizeOfHeaders);
	printf("SectionAlignment:\t\t0x%08X\r\n", pOptionHeader->SectionAlignment);
	printf("FileAlignment:\t\t\t0x%08X\r\n", pOptionHeader->FileAlignment);

	// 节表的位置 = 可选PE头的位置 + 可选PE头的大小
	pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader + pPEHeader->SizeOfOptionalHeader);
	printf("==============================节表信息如下===============================\n");
	//printf("name:0x%s\n",pSectionHeader->Misc);
	DWORD dwNumberOfSection = pPEHeader->NumberOfSections;
	printf("节表的数量：%d\n", dwNumberOfSection);
	/*
	printf("0x%x\n",pPEHeader->NumberOfSections);
	printf("IMAGE_SIZEOF_SHORT_NAME:0x%x\n",IMAGE_SIZEOF_SHORT_NAME);
	printf("option_add:0x%x\n",pOptionHeader);
	printf("psection_add:0x%x\n",pSectionHeader);
	printf("==============================================================\n");*/
	for (DWORD i = 0; i < dwNumberOfSection; i++, pSectionHeader++) {
		printf("========================第%d个节信息：===============================\n", i + 1);
		printf("section_name: ");

		for (DWORD j = 0; j < IMAGE_SIZEOF_SHORT_NAME; j++) {
			printf("%c", pSectionHeader->Name[j]);
		}

		printf("\r\n");
		printf("Misc:\t\t\t\t0x%08X\r\n", pSectionHeader->Misc);
		printf("VirtualAddress:\t\t\t0x%08X\r\n", pSectionHeader->VirtualAddress);
		printf("SizeOfRawData:\t\t\t0x%08X\r\n", pSectionHeader->SizeOfRawData);
		printf("PointerToRawData:\t\t0x%08X\r\n", pSectionHeader->PointerToRawData);
		printf("Characteristics:\t\t0x%08X\r\n", pSectionHeader->Characteristics);
	}
}

int main(int argc, char* argv[])
{
	PrintNTHeaders();

	system("pause");

	return 0;
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248

#pragma warning(disable : 4996)
#include <malloc.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <windows.h>

#define test 1

DWORD ToLoaderPE(LPSTR file_path, PVOID* pFileBuffer);

DWORD CopyFileBufferToImageBuffer(PVOID pFileBuffer, PVOID* pImageBuffer);
DWORD CopyImageBufferToNewFileBuffer(PVOID pImageBuffer, PVOID* pNewFileBuffer);
BOOL MemoryToFile(PVOID pMemBuffer, DWORD size, LPSTR lpszFile);

//char file_path[] = "C:\\Windows\\System32\\notepad.exe";
char file_path[] = "notepad.exe";
char imageBuffer_file_path[] = "imageBuffer.exe";
char fileBuffer_file_path[] = "fileBuffer.exe";

//返回PE文件大小
DWORD ToLoaderPE(LPSTR file_path, PVOID* pFileBuffer) {
	FILE* pFile = NULL;
	DWORD FileSize = 0;
	PVOID pFileBufferTemp = NULL;

	pFile = fopen(file_path, "rb");

	if (!pFile) {
		printf("(ToLoaderPE)Can't open file!\n");
		return 0;
	}

	fseek(pFile, 0, SEEK_END);
	FileSize = ftell(pFile);
	printf("FileBuffer: %#x\n", FileSize);
	fseek(pFile, 0, SEEK_SET);
	pFileBufferTemp = malloc(FileSize);

	if (!pFileBufferTemp) {
		printf("(ToLoaderPE)Allocate dynamic memory failed!\n");
		fclose(pFile);
		return 0;
	}

	DWORD n = fread(pFileBufferTemp, FileSize, 1, pFile);

	if (!n) {
		printf("(ToLoaderPE)Read file failed!\n");
		free(pFileBufferTemp);
		fclose(pFile);
		return 0;
	}

	*pFileBuffer = pFileBufferTemp;
	pFileBufferTemp = NULL;
	fclose(pFile);

	return FileSize;
}

DWORD CopyFileBufferToImageBuffer(PVOID pFileBuffer, PVOID* pImageBuffer) {
	PIMAGE_DOS_HEADER pDosHeader = NULL;
	PIMAGE_NT_HEADERS pNTHeader = NULL;
	PIMAGE_FILE_HEADER pPEHeader = NULL;
	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;

	PVOID pImageTemp = NULL;

	if (!pFileBuffer) {
		printf("(CopyFileBufferToImageBuffer)Can't open file!\n");
		return 0;
	}

	if (*((PWORD)pFileBuffer) != IMAGE_DOS_SIGNATURE) {
		printf("(CopyFileBufferToImageBuffer)No MZ flag, not exe file!\n");
		return 0;
	}

	pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;

	if (*((LPDWORD)((DWORD)pFileBuffer + pDosHeader->e_lfanew)) !=
		IMAGE_NT_SIGNATURE) {
		printf("(CopyFileBufferToImageBuffer)Not a valid PE flag!\n");
		return 0;
	}

	pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pFileBuffer + pDosHeader->e_lfanew);
	pPEHeader = (PIMAGE_FILE_HEADER)(((DWORD)pNTHeader) + 4);
	pOptionHeader =
		(PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + IMAGE_SIZEOF_FILE_HEADER);
	pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader +
		pPEHeader->SizeOfOptionalHeader);

	// 分配内存中整个PE文件的映射的尺寸
	pImageTemp = malloc(pOptionHeader->SizeOfImage);

	if (!pImageTemp) {
		printf("(CopyFileBufferToImageBuffer)Allocate dynamic memory failed!\n");
		free(pImageTemp);
		return 0;
	}

	memset(pImageTemp, 0, pOptionHeader->SizeOfImage);
	// pOptionHeader->SizeOfHeaders：所有头+节表按照文件对齐后的大小
	// 填充所有头+节表(按照文件对齐的方式)
	memcpy(pImageTemp, pDosHeader, pOptionHeader->SizeOfHeaders);

	PIMAGE_SECTION_HEADER pSectionHeaderTemp = pSectionHeader;

	for (int n = 0; n < pPEHeader->NumberOfSections; n++, pSectionHeaderTemp++) {
		/**
		 * VirtualAddress：节区在内存中的偏移地址。加上ImageBase才是在内存中的真正地址.
		 * PointerToRawData：节区在文件中的偏移
		 * SizeOfRawData：节在文件中对齐后的尺寸
		 */
		memcpy((PVOID)((DWORD)pImageTemp + pSectionHeaderTemp->VirtualAddress),
			(PVOID)((DWORD)pFileBuffer + pSectionHeaderTemp->PointerToRawData),
			pSectionHeaderTemp->SizeOfRawData);
		printf("VirtualAddress%d: %#10x         PointerToRawData%d: %#10x\n",
			n, (DWORD)pImageTemp + pSectionHeader->VirtualAddress,
			n, (DWORD)pFileBuffer + pSectionHeader->PointerToRawData);
	}
	*pImageBuffer = pImageTemp;
	pImageTemp = NULL;

	//内存中整个PE文件的映射的尺寸，可以比实际的值大，但必须是SectionAlignment的整数倍
	return pOptionHeader->SizeOfImage;
}

DWORD CopyImageBufferToNewFileBuffer(PVOID pImageBuffer, PVOID* pNewFileBuffer) {
	PIMAGE_DOS_HEADER pDosHeader = NULL;
	PIMAGE_NT_HEADERS pNTHeader = NULL;
	PIMAGE_FILE_HEADER pPEHeader = NULL;
	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;

	LPVOID pTempNewbuffer = NULL;

	if (!pImageBuffer) {
		printf("(CopyImageBufferToNewBuffer)Can't open file!\n");
		return 0;
	}

	if (*((PWORD)pImageBuffer) != IMAGE_DOS_SIGNATURE) {
		printf("(CopyImageBufferToNewBuffer)No MZ flag, not exe file!\n");
		return 0;
	}

	pDosHeader = (PIMAGE_DOS_HEADER)pImageBuffer;
	if (*((PDWORD)((DWORD)pImageBuffer + pDosHeader->e_lfanew)) !=
		IMAGE_NT_SIGNATURE) {
		printf("(CopyImageBufferToNewBuffer)Not a valid PE flag!\n");
		return 0;
	}

	pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pImageBuffer + pDosHeader->e_lfanew);
	pPEHeader =
		(PIMAGE_FILE_HEADER)((DWORD)pNTHeader + 4); // 这里必须强制类型转换
	pOptionHeader =
		(PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + IMAGE_SIZEOF_FILE_HEADER);
	pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader +
		pPEHeader->SizeOfOptionalHeader);

	/**
	 * 计算ImageBuffer => FileBuffer的大小
	 *		SizeOfHeaders：所有头+节表按照文件对齐后的大小
	 *		SizeOfRawData：节在文件中对齐后的尺寸
	 */
	int new_buffer_size = pOptionHeader->SizeOfHeaders;
	for (DWORD i = 0; i < pPEHeader->NumberOfSections; i++) {
			new_buffer_size += pSectionHeader[i].SizeOfRawData; 
	}

	// 分配内存(newbuffer)
	pTempNewbuffer = malloc(new_buffer_size);
	if (!pTempNewbuffer) {
		printf("(CopyImageBufferToNewBuffer)Allocate dynamic memory failed!\n");
		return 0;
	}

	// 拷贝所有头+节表
	memset(pTempNewbuffer, 0, new_buffer_size);
	memcpy(pTempNewbuffer, pDosHeader, pOptionHeader->SizeOfHeaders);

	// 循环拷贝节区
	/**
	 * PointerToRawData：节区在文件中的偏移.
	 * VirtualAddress：节区在内存中的偏移地址
	 * SizeOfRawData：节在文件中对齐后的尺寸
	 */
	PIMAGE_SECTION_HEADER pTempSectionHeader = pSectionHeader;
	for (DWORD j = 0; j < pPEHeader->NumberOfSections; j++, pTempSectionHeader++) {
		memcpy(
			(PDWORD)((DWORD)pTempNewbuffer + pTempSectionHeader->PointerToRawData),
			(PDWORD)((DWORD)pImageBuffer + pTempSectionHeader->VirtualAddress),
			pTempSectionHeader->SizeOfRawData);
	}

	//返回数据
	*pNewFileBuffer = pTempNewbuffer; //暂存的数据传给参数后释放
	pTempNewbuffer = NULL;
	return new_buffer_size; // 返回计算得到的分配内存的大小
}

BOOL MemoryToFile(PVOID pMemBuffer, DWORD size, LPSTR lpszFile) {
	FILE* fp;
	fp = fopen(lpszFile, "wb");
	if (fp != NULL) {
		fwrite(pMemBuffer, size, 1, fp);
	}
	fclose(fp);

	return 1;
}

VOID operate() {
	LPVOID pFileBuffer = NULL;
	LPVOID pNewFileBuffer = NULL;
	LPVOID pImageBuffer = NULL;

	DWORD ret1 = ToLoaderPE(
		file_path,
		&pFileBuffer); // &pFileBuffer(void**类型) 传递地址对其值可以进行修改
	printf("exe->filebuffer  返回值为计算所得文件大小：%#x\n", ret1);

	DWORD ret2 = CopyFileBufferToImageBuffer(pFileBuffer, &pImageBuffer);
	printf("filebuffer -> imagebuffer返回值为计算所得文件大小：%#x\n", ret2);

	MemoryToFile(pImageBuffer, ret2, imageBuffer_file_path);

	DWORD ret3 = CopyImageBufferToNewFileBuffer(pImageBuffer, &pNewFileBuffer);
	printf("imagebuffer -> newfilebuffer返回值为计算所得文件大小：%#x\n", ret3);

	MemoryToFile(pNewFileBuffer, ret3, fileBuffer_file_path);

	free(pFileBuffer);
	free(pNewFileBuffer);
	free(pImageBuffer);
}

int main() {
	operate();
	system("pause");

	return 0;
}

1

int MessageBox( HWND hWnd,LPCTSTR lpText, LPCTSTR lpCaption = NULL, UINT nType = MB_OK);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

#include <iostream>

void Function(int a, int b, int c, int d) {
}

int main(int argc, char* argv[]) {
    Function(1, 2, 3, 4);

    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

vs2019_project_test.exe!main(int, char * *):
00E817A0 55                   push        ebp  
00E817A1 8B EC                mov         ebp,esp  
00E817A3 81 EC C0 00 00 00    sub         esp,0C0h  
00E817A9 53                   push        ebx  
00E817AA 56                   push        esi  
00E817AB 57                   push        edi  
00E817AC 8B FD                mov         edi,ebp  
00E817AE 33 C9                xor         ecx,ecx  
00E817B0 B8 CC CC CC CC       mov         eax,0CCCCCCCCh  
00E817B5 F3 AB                rep stos    dword ptr es:[edi]  
00E817B7 B9 00 C0 E8 00       mov         ecx,offset _E4C34A80_main@cpp (0E8C000h)  
00E817BC E8 4B FB FF FF       call        @__CheckForDebuggerJustMyCode@4 (0E8130Ch)  
00E817C1 6A 04                push        4  
00E817C3 6A 03                push        3  
00E817C5 6A 02                push        2  
00E817C7 6A 01                push        1  
00E817C9 E8 95 F9 FF FF       call        Function (0E81163h)  
00E817CE 83 C4 10             add         esp,10h  
00E817D1 33 C0                xor         eax,eax  
00E817D3 5F                   pop         edi  
00E817D4 5E                   pop         esi  
00E817D5 5B                   pop         ebx  
00E817D6 81 C4 C0 00 00 00    add         esp,0C0h  
00E817DC 3B EC                cmp         ebp,esp  
00E817DE E8 52 FA FF FF       call        __RTC_CheckEsp (0E81235h)  
00E817E3 8B E5                mov         esp,ebp  
00E817E5 5D                   pop         ebp  
00E817E6 C3                   ret  

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

bp MessageBoxA：0x77D507EA  

AddressOfEntryPoint程序入口：0x0000739D

ImageBase装载地址：0x01000000

.txt 
	VirtualAddress内存中的偏移地址: 0x1000
	VirtualSize该节在没有对齐前的真实尺寸: 0x7748
	PointerToRawData节区在文件中的偏移:0x400

加入代码的地方 0x7B48 = PointerToRawData + VirtualSize = 0x7748 + 0x400

通过下一个节表的PointerToRawData字段值为0x7c00，综合0x7172可以判断出.text节的空白区大小为0x7c00 - 0x7B48 = 0xB8。空间还很大，所以我们可以将代码添加在这个空白区的任意大小合适的位置。

接着就是构造ShellCode：

从0x7B48处填充：6A 00 6A 00 6A 00 6A 00 E8 00 00 00 00 E9 00 00 00 00

由于现在加的位置是文件在硬盘上的地址，不是加载到ImageBuffer中的地址，所以要做地址转换。

.text节在内存中的起始地址 VirtualAddress + ImageBase：0x1000 + 0x01000000 = 0x1001000

E8的文件地址: 0x7B50   相对于.txt的偏移位置：0x7750 = 0x7B50 - PointerToRawData = 0x7B50 - 0x400
E8的内存地址：0x7750 + 0x1001000 = 0x1008750
E8后面的 MessageBoxA - (E8的内存地址+5): 0x77D507EA - 0x1008750 - 5 = 0x76D48095

E9的文件地址: 0x7B55   相对于.txt的偏移位置：0x7755 = 0x7B55 - PointerToRawData = 0x7B55 - 0x400
E9的内存地址：0x7755 + 0x1001000 = 0x1008755

实际程序加载到内存的入口：运行入口AddressOfEntryPoint + ImageBase：0x0000739D + 0x01000000 = 0x100739D
E9后面的 运行入口 - (E9的内存地址+5): 0x100739D - 0x1008755- 5 = 0x76D48090 = 0xFFFFEC43

E9相当于最终调转到实际程序加载到内存的入口的地方。

最终0x7B48处填充：6A 00 6A 00 6A 00 6A 00 E8 95 80 D4 76 E9 43 EC FF FF

加入代码的地方的内存入口 VirtualSize + VirtualAddress：0x7748 + 0x1000 = 0x8748

重新设置AddressOfEntryPoint程序入口 = 0x8748

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353

#pragma warning(disable : 4996)
#include <iostream>
#include <string.h>

typedef unsigned short WORD;
typedef unsigned int DWORD;
typedef unsigned char BYTE;

#define MZ 0x5A4D
#define PE 0x4550
#define IMAGE_SIZEOF_SHORT_NAME 8

#define MessageBox_Address 0x754034B0 //宏定义的MessageBox内存地址

const char* filePath = "CRACKME.EXE";  //你要打开的PE文件路径
const char* storagePath = "new_CRACKME.exe"; //保存路径

//shellcode：定义要添加的硬编码全局变量，确定的写好，不确定的先用0x00填充，后面计算完再改
BYTE shellcode[] = {
	0x6A,0x00,0x6A,0x00,0x6A,0x00,0x6A,0x00,
	0xE8,0x00,0x00,0x00,0x00,
	0xE9,0x00,0x00,0x00,0x00
};

//DOS头
struct _IMAGE_DOS_HEADER {
	WORD e_magic;  //MZ标记
	WORD e_cblp;
	WORD e_cp;
	WORD e_crlc;
	WORD e_cparhdr;
	WORD e_minalloc;
	WORD e_maxalloc;
	WORD e_ss;
	WORD e_sp;
	WORD e_csum;
	WORD e_ip;
	WORD e_cs;
	WORD e_lfarlc;
	WORD e_ovno;
	WORD e_res[4];
	WORD e_oemid;
	WORD e_oeminfo;
	WORD e_res2[10];
	DWORD e_lfanew;  //PE文件真正开始的偏移地址
};

//标准PE头
struct _IMAGE_FILE_HEADER {
	WORD Machine;  //文件运行平台
	WORD NumberOfSections;  //节数量
	DWORD TimeDateStamp;  //时间戳
	DWORD PointerToSymbolTable;
	DWORD NumberOfSymbols;
	WORD SizeOfOptionalHeader;  //可选PE头大小
	WORD Characteristics;  //特征值
};

//可选PE头
struct _IMAGE_OPTIONAL_HEADER {
	WORD Magic;  //文件类型
	BYTE MajorLinkerVersion;
	BYTE MinorLinkerVersion;
	DWORD SizeOfCode;   //代码节文件对齐后的大小
	DWORD SizeOfInitializedData;  //初始化数据文件对齐后的大小
	DWORD SizeOfUninitializedData;  //未初始化数据文件对齐后大小
	DWORD AddressOfEntryPoint;  //程序入口点(偏移量)
	DWORD BaseOfCode;  //代码基址
	DWORD BaseOfData;  //数据基址
	DWORD ImageBase;   //内存镜像基址
	DWORD SectionAlignment;  //内存对齐粒度
	DWORD FileAlignment;  //文件对齐粒度
	WORD MajorOperatingSystemVersion;
	WORD MinorOperatingSystemVersion;
	WORD MajorImageVersion;
	WORD MinorImageVersion;
	WORD MajorSubsystemVersion;
	WORD MinorSubsystemVersion;
	DWORD Win32VersionValue;
	DWORD SizeOfImage;  //文件装入虚拟内存后大小
	DWORD SizeOfHeaders;  //DOS、NT头和节表大小
	DWORD CheckSum;  //校验和
	WORD Subsystem;
	WORD DllCharacteristics;
	DWORD SizeOfStackReserve;  //预留堆栈大小
	DWORD SizeOfStackCommit;  //实际分配堆栈大小
	DWORD SizeOfHeapReserve;  //预留堆大小
	DWORD SizeOfHeapCommit;  //实际分配堆大小
	DWORD LoaderFlags;
	DWORD NumberOfRvaAndSizes;  //目录项数目
	//_IMAGE_DATA_DIRECTORY DataDirectory[16];  //这个先不管
};

//NT头
struct _IMAGE_NT_HEADERS {
	DWORD Signature;  //PE签名
	_IMAGE_FILE_HEADER FileHeader;
	_IMAGE_OPTIONAL_HEADER OptionalHeader;
};

//节表
struct _IMAGE_SECTION_HEADER {
	BYTE Name[IMAGE_SIZEOF_SHORT_NAME];  //节表名
	union {
		DWORD PhysicalAddress;
		DWORD VirtualSize;  //内存中未对齐大小
	}Misc;
	DWORD VirtualAddress;  //该节在内存中偏移地址
	DWORD SizeOfRawData;  //该节在硬盘上文件对齐后大小
	DWORD PointerToRawData;  //该节在硬盘上文件对齐后偏移地址
	DWORD PointerToRelocations;
	DWORD PointerToLinenumbers;
	WORD NumberOfRelocations;
	WORD NumberOfLinenumbers;
	DWORD Characteristics;  //该节特征属性
};

/*计算文件大小函数
参数：文件绝对路径
返回值：返回文件大小(单位字节)
*/
int compute_file_size(const char* filePath) {
	FILE* fp = fopen(filePath, "rb");
	if (!fp) {
		printf("打开文件失败");
		exit(0);
	}
	fseek(fp, 0, 2);
	int size = ftell(fp);
	//fseek(fp,0,0); 单纯计算文件大小，就不需要还原指针了
	fclose(fp);
	return size;
}

/*将文件读入FileBuffer函数
参数：文件绝对路径
返回值：FileBuffer起始地址
*/
char* to_FileBuffer(const char* filePath) {
	FILE* fp = fopen(filePath, "rb");
	if (!fp) {
		printf("打开文件失败");
		exit(0);
	}
	int size = compute_file_size(filePath);

	char* mp = (char*)malloc(sizeof(char) * size);  //分配内存空间
	if (!mp) {
		printf("分配空间失败");
		fclose(fp);
		exit(0);
	}

	int isSucceed = fread(mp, size, 1, fp);
	if (!isSucceed) {
		printf("读取数据失败");
		free(mp);
		fclose(fp);
		exit(0);
	}

	fclose(fp);
	return mp;
}

/*FileBuffer到ImageBuffer函数
参数：FileBuffer起始地址
返回值：ImageBuffer起始地址
*/
char* fileBuffer_to_ImageBuffer(char* fileBufferp) {

	_IMAGE_DOS_HEADER* _image_dos_header = NULL;
	_IMAGE_FILE_HEADER* _image_file_header = NULL;
	_IMAGE_OPTIONAL_HEADER* _image_optional_header = NULL;
	_IMAGE_SECTION_HEADER* _image_section_header = NULL;

	_image_dos_header = (_IMAGE_DOS_HEADER*)fileBufferp;
	_image_file_header = (_IMAGE_FILE_HEADER*)(fileBufferp + _image_dos_header->e_lfanew + 4);
	_image_optional_header = (_IMAGE_OPTIONAL_HEADER*)((char*)_image_file_header + 20);
	_image_section_header = (_IMAGE_SECTION_HEADER*)((char*)_image_optional_header + _image_file_header->SizeOfOptionalHeader);

	DWORD sizeofImage = _image_optional_header->SizeOfImage;
	char* imageBufferp = (char*)malloc(sizeofImage);
	if (NULL == imageBufferp) {
		printf("动态申请ImageBuffer内存失败\n");
		exit(0);
	}
	memset(imageBufferp, 0, sizeofImage);

	// 复制所有头
	memcpy(imageBufferp, fileBufferp, _image_optional_header->SizeOfHeaders);


	// 将文件中的节表复制到内存上
	for (int i = 0; i < _image_file_header->NumberOfSections; ++i) {
		memcpy(imageBufferp + _image_section_header[i].VirtualAddress, fileBufferp + _image_section_header[i].PointerToRawData, _image_section_header[i].SizeOfRawData);
	}

	return imageBufferp;
}

/*计算NewBuffer大小函数
参数：NewBuffer起始地址
返回值：unsigned int类型(单位：字节)
*/
DWORD compute_NewBuffer_size(char* newBufferp) {
	_IMAGE_DOS_HEADER* _image_dos_header = NULL;
	_IMAGE_FILE_HEADER* _image_file_header = NULL;
	_IMAGE_OPTIONAL_HEADER* _image_optional_header = NULL;
	_IMAGE_SECTION_HEADER* _image_section_header = NULL;

	_image_dos_header = (_IMAGE_DOS_HEADER*)newBufferp;
	_image_file_header = (_IMAGE_FILE_HEADER*)(newBufferp + _image_dos_header->e_lfanew + 4);
	_image_optional_header = (_IMAGE_OPTIONAL_HEADER*)((char*)_image_file_header + 20);
	_image_section_header = (_IMAGE_SECTION_HEADER*)((char*)_image_optional_header + _image_file_header->SizeOfOptionalHeader);

	_IMAGE_SECTION_HEADER* last_image_section_header = _image_section_header + _image_file_header->NumberOfSections - 1;
	DWORD sizeofNewBuffer = last_image_section_header->PointerToRawData + last_image_section_header->SizeOfRawData;
	return sizeofNewBuffer;
}

/*ImageBuffer到NewBuffer函数
参数：ImageBuffer起始地址
返回值：NewBuffer起始地址
*/
char* imageBuffer_to_NewBuffer(char* imageBufferp) {

	_IMAGE_DOS_HEADER* _image_dos_header = NULL;
	_IMAGE_FILE_HEADER* _image_file_header = NULL;
	_IMAGE_OPTIONAL_HEADER* _image_optional_header = NULL;
	_IMAGE_SECTION_HEADER* _image_section_header = NULL;

	_image_dos_header = (_IMAGE_DOS_HEADER*)imageBufferp;
	_image_file_header = (_IMAGE_FILE_HEADER*)(imageBufferp + _image_dos_header->e_lfanew + 4);
	_image_optional_header = (_IMAGE_OPTIONAL_HEADER*)((char*)_image_file_header + 20);
	_image_section_header = (_IMAGE_SECTION_HEADER*)((char*)_image_optional_header + _image_file_header->SizeOfOptionalHeader);

	//重新计算newBuffer需要大小
	/*方法一:SizeOfHEADER + 所有节的SizeOfRawData之和
	int sizeofSections = 0;
	_IMAGE_SECTION_HEADER* _image_section_header_temp = _image_section_header;
	for(DWORD int i = 0;i < _image_file_header->NumberOfSections;i++){
		sizeofSections += _image_section_header_temp->SizeOfRawData;
		_image_section_header_temp++;
	}
	char* newBufferp = (char*)malloc(_image_optional_header->SizeOfHeaders + sizeofSections);
	*/

	//方法二:使用最后一个节的文件偏移地址 + 最后一个节对齐后的大小
	DWORD size = compute_NewBuffer_size(imageBufferp);
	char* newBufferp = (char*)malloc(size);
	if (NULL == newBufferp) {
		printf("NewBuffer内存分配失败\n");
		exit(0);
	}

	memset(newBufferp, 0, size);
	memcpy(newBufferp, imageBufferp, _image_optional_header->SizeOfHeaders);

	for (int i = 0; i < _image_file_header->NumberOfSections; i++) {
		memcpy(newBufferp + _image_section_header[i].PointerToRawData, imageBufferp + _image_section_header[i].VirtualAddress, _image_section_header[i].SizeOfRawData);
	}

	return newBufferp;
}

/*NewBuffer存盘函数
参数：需要写出数据的内存首地址，保存绝对路径，写出的数据大小(单位：字节)
返回值：成功返回1，失败返回0
*/
int save_to_disk(char* newBufferp, const char* storagePath, DWORD size) {
	FILE* fp = fopen(storagePath, "wb");
	if (!fp) {
		printf("打开文件失败");
		return 0;
	}
	int isSucceed = fwrite(newBufferp, size, 1, fp);
	if (!isSucceed) {
		free(newBufferp);
		fclose(fp);
		return 0;
	}
	fclose(fp);
	return 1;
}

/*向第一个节.text中注入shellcode函数
参数：要注入的可执行文件的ImageBuffer起始地址
返回值：0则注入失败，1则注入成功
*/
int add_shellcode(char* imageBufferp) {
	_IMAGE_DOS_HEADER* _image_dos_header = NULL;
	_IMAGE_FILE_HEADER* _image_file_header = NULL;
	_IMAGE_OPTIONAL_HEADER* _image_optional_header = NULL;
	_IMAGE_SECTION_HEADER* _image_section_header = NULL;

	_image_dos_header = (_IMAGE_DOS_HEADER*)imageBufferp;
	_image_file_header = (_IMAGE_FILE_HEADER*)(imageBufferp + _image_dos_header->e_lfanew + 4);
	_image_optional_header = (_IMAGE_OPTIONAL_HEADER*)((char*)_image_file_header + 20);
	_image_section_header = (_IMAGE_SECTION_HEADER*)((char*)_image_optional_header + _image_file_header->SizeOfOptionalHeader);

	/** 
	*  用SizeofRawData - VirtualSize判断空白区是否存的下shellcode：这里要考虑到一个问题：我们使用的是secp->VirtualAddress + secp->Misc.VirtualSize来确定内存中此节的空白区的偏移起始地址，
	*  这个算法是没错的，但是还记得前面将FileBuffer装载到ImageBuffer时我们复制每个节的长度是按照SizeOfRawData复制的，而且ImageBuffer到NewBuffer也是每个节按照SizeOfRawData复制的。
	*  那么如果某一个节的VirtualSize>SizeOfRawData，就会出现我们添加代码的地方确实在节装入内存时的空白区，
	*  但是最后ImageBuffer到NewBuffer时，复制的时候只复制了这个节开始的SizeOfRawData个字节，我们加的代码并没有复制进去，就可能出现问题，所以干脆直接要求SizeOfRawData > VirtualSize才能注入
	*/
	if ((int)(_image_section_header->SizeOfRawData - _image_section_header->Misc.VirtualSize) < sizeof(shellcode) / sizeof(shellcode[0])) {
		printf("此节空白区大小不够，添加失败");
		return 0;
	}

	//将shellcode注入到节空白区
	char* shellcode_ptr = imageBufferp + _image_section_header->VirtualAddress + _image_section_header->Misc.VirtualSize;	//计算插入代码的位置
	char* newOEP = shellcode_ptr;  //此shellcode注入起始地址即为新的OEP地址
	memcpy(shellcode_ptr, shellcode, sizeof(shellcode) / sizeof(shellcode[0]));

	//修改call MessageBox的硬编码E8后面的4字节
	DWORD E8_fill_value = MessageBox_Address - ((shellcode_ptr - imageBufferp + _image_optional_header->ImageBase) + 8 + 5);
	*(DWORD*)(shellcode_ptr + 9) = E8_fill_value;

	//修改jmp 原OEP的硬编码E9后面的4字节
	DWORD E9_fill_value = _image_optional_header->AddressOfEntryPoint - (shellcode_ptr - imageBufferp + 8 + 5 + 5);
	*(DWORD*)(shellcode_ptr + 14) = E9_fill_value;

	//修改OEP指向shellcode
	_image_optional_header->AddressOfEntryPoint = (DWORD)(newOEP - imageBufferp);

	return 1;
}

int main(int argc, char* argv[]) {
	char* fileBufferp = to_FileBuffer(filePath);
	char* imageBufferp = fileBuffer_to_ImageBuffer(fileBufferp);

	// 注入提示框
	if (!add_shellcode(imageBufferp)) {
		printf("shellcode注入失败");
		return 0;
	}

	char* newBufferp = imageBuffer_to_NewBuffer(imageBufferp);
	int isSucceed = save_to_disk(newBufferp, storagePath, compute_NewBuffer_size(newBufferp));
	if (!isSucceed)
		printf("存盘失败");
	else
		printf("存盘成功");

	free(fileBufferp);
	free(imageBufferp);
	free(newBufferp);
	return 0;
}