#include "stdafx.h"
#include "petool.h"
#include "string.h"
#define SRC "C:\\Users\\Administrator\\Desktop\\TraceMe.exe"
#define DEST "C:\\Users\\Administrator\\Desktop\\copy1.exe"
//扩大最后一个节
void lastSecInc(){
//定义头结构指针
PIMAGE_DOS_HEADER dosHeader = NULL; //dos头指针
PIMAGE_FILE_HEADER peHeader = NULL; //pe头指针
PIMAGE_OPTIONAL_HEADER32 opHeader = NULL; //可选pe头指针
PIMAGE_SECTION_HEADER seHeader = NULL; //节表指针
PIMAGE_SECTION_HEADER lastSeHeader = NULL; //最后一个节表指针
LPVOID pFileBuffer = NULL;
//1.加载文件到内存
DWORD size = ReadPEFile(SRC, &pFileBuffer);
if(!pFileBuffer){
printf("读取文件失败\n");
return;
}
//2.拉伸文件镜像
LPVOID pImageBuffer = NULL;
DWORD imageSize = CopyFileBufferToImageBuffer(pFileBuffer, &pImageBuffer);
if(!imageSize){
printf("拉伸文件失败\n");
free(pFileBuffer);
return;
}
//4.扩大内存镜像
LPVOID newImageBuffer = NULL;
DWORD newImageSize = imageSize + 0x1000; //目标文件的内存对齐是1000文件对齐是200，就扩大1000正好为两个数的整数倍
newImageBuffer = malloc(newImageSize);
if(! newImageBuffer){
printf("给扩大后的内存镜像申请内存失败\n");
free(pFileBuffer);
free(pImageBuffer);
return;
}
//初始化内存空间
memset(newImageBuffer, 0, newImageSize);
//复制内存镜像到新的空间
memcpy(newImageBuffer, pImageBuffer, imageSize);
//4.初始化头指针
dosHeader = (PIMAGE_DOS_HEADER) newImageBuffer;
peHeader = (PIMAGE_FILE_HEADER)((DWORD)newImageBuffer + dosHeader->e_lfanew + 4);
opHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)peHeader + IMAGE_SIZEOF_FILE_HEADER);
seHeader = (PIMAGE_SECTION_HEADER)((DWORD)opHeader + peHeader->SizeOfOptionalHeader);
//5.修改头部信息
//修改节表信息
lastSeHeader = seHeader + (peHeader->NumberOfSections - 1);
lastSeHeader->Misc.VirtualSize = lastSeHeader->Misc.VirtualSize + 0x1000;
lastSeHeader->SizeOfRawData = lastSeHeader->SizeOfRawData + 0x1000;
//修改SizeOfImage
opHeader->SizeOfImage = opHeader->SizeOfImage+0x1000;
//6.压缩新内存镜像
LPVOID newBuffer = NULL;
DWORD newBufferSize = CopyImageBufferToNewBuffer(newImageBuffer, &newBuffer);
if(!newBufferSize){
printf("压缩新内存镜像失败\n");
free(pFileBuffer);
free(pImageBuffer);
free(newImageBuffer);
return;
}
//7.写出文件
BOOL isOk = MemeryTOFile(newBuffer, newBufferSize, DEST);
if(!isOk){
printf("存盘失败\n");
}else{
printf("存盘成功\n");
}
//8.释放内存
free(pFileBuffer);
free(pImageBuffer);
free(newImageBuffer);
free(newBuffer);
return;
}
int main(int argc, char* argv[])
{
lastSecInc();
getchar();
return 0;
}
SizeOfRawData = VirtualSize = 最后一个节的VirtualAddress + Max - SizeOfHeaders内存对齐后的大小
.png)
.png)
