PE头的应用---插入代码到EXE或DLL文件中
三、代码实现（DELPHI版本），采用第三种方式实现代码插入。
1. 定义两个类，一个用来实现在内存中建立输入表；一个用来实现对PE头的代码插入。
DelphiCode:
const MAX_SECTION_NUM = 20;
const DYN_LOADER_START_MAGIC = $C0DE51A9;
const DYN_LOADER_END_MAGIC = $C0DEE2DE;
const DYN_LOADER_START_DATA1 = $DA1EDA1E;
const IMPORT_TABLE_EXE = 0;
const IMPORT_TABLE_DLL = 1;
Type
TIIDUnion = record
case Integer of
0: (Characteristics: DWORD); // 0 for terminating null import descriptor
1: (OriginalFirstThunk: DWORD); // RVA to original unbound IAT (PIMAGE_THUNK_DATA)
end;
PIMAGE_IMPORT_DESCRIPTOR = ^IMAGE_IMPORT_DESCRIPTOR;
{$EXTERNALSYM PIMAGE_IMPORT_DESCRIPTOR}
_IMAGE_IMPORT_DESCRIPTOR = record
Union: TIIDUnion;
TimeDateStamp: DWORD;
ForwarderChain: DWORD;
Name: DWORD;
FirstThunk: DWORD;
end;
{$EXTERNALSYM _IMAGE_IMPORT_DESCRIPTOR}
IMAGE_IMPORT_DESCRIPTOR = _IMAGE_IMPORT_DESCRIPTOR;
{$EXTERNALSYM IMAGE_IMPORT_DESCRIPTOR}
TImageImportDecriptor = IMAGE_IMPORT_DESCRIPTOR;
PImageImportDecriptor = PIMAGE_IMPORT_DESCRIPTOR;
PIMAGE_TLS_DIRECTORY32 = ^IMAGE_TLS_DIRECTORY32;
{$EXTERNALSYM PIMAGE_TLS_DIRECTORY32}
_IMAGE_TLS_DIRECTORY32 = record
StartAddressOfRawData: DWORD;
EndAddressOfRawData: DWORD;
AddressOfIndex: DWORD;
AddressOfCallBacks: DWORD;
SizeOfZeroFill: DWORD;
Characteristics: DWORD;
end;
{$EXTERNALSYM _IMAGE_TLS_DIRECTORY32}
IMAGE_TLS_DIRECTORY32 = _IMAGE_TLS_DIRECTORY32;
{$EXTERNALSYM IMAGE_TLS_DIRECTORY32}
TImageTlsDirectory32 = IMAGE_TLS_DIRECTORY32;
PImageTlsDirectory32 = PIMAGE_TLS_DIRECTORY32;
PImageImport = ^TImageImport;
TImageImport = packed record
szLibrary : array[0..31] of char;
ThunksList : TList;
end;
{在内存中建立一个输入表的内存块，地址放在pMem中,大小是dwSize}
TImportTableMaker = class
private
function GetIATSize : DWORD;
procedure Init(iType : integer);
protected
ImportTable : TList;
public
dwSize : DWORD;
pMem : Pointer;
constructor Create(iType : integer);
destructor Destroy; override;
procedure Build(baseRVA : DWORD);
end;
{用来传递数据的一个结构}
PData = ^TData;
TData = record
dwReserved1 : DWORD;
dwFileType : DWORD;
dwImageBase : DWORD;
dwOrgEntryPoint : DWORD;
dwImportVAddr : DWORD;
dwRelocationVAddr : DWORD;
dwRelocationSize : DWORD;
imgTLSDirectory : IMAGE_TLS_DIRECTORY32;
end;
TPE = class
private
dwFileSize : DWORD;
pMem : Pointer;
SectionNum : integer;
pNewSection : Pointer;
function ReturnToBytePtr(FuncCode : pointer; findstr : DWORD): pointer;
procedure SetSectionsWritePermission;
procedure CopyData(dwVirtualAddress : DWORD);
protected
ITMaker : TImportTableMaker;
imgDosHeader : TImageDosHeader;
pDosStub : Pointer;
dwDosStubSize : DWORD;
dwDosStubOffset : DWORD;
imgNtHeaders : TImageNtHeaders;
imgSectionHeaders : array[0..MAX_SECTION_NUM -1] of TImageSectionHeader;
imgSections : array[0..MAX_SECTION_NUM -1] of Pointer;
imgTLSDirectory : IMAGE_TLS_DIRECTORY32;
function PEAlign(dwTarNum : DWORD; dwAlignTo : DWORD) : DWORD;
procedure AlignmentSections;
function Offset2RVA(dwOffset : DWORD) : DWORD;
function RVA2Offset(dwRVA : DWORD) : DWORD;
function ImgRVA2Section(dwRVA : DWORD) : PImageSectionHeader;
function ImgOffset2Section(dwOffset: DWORD): PImageSectionHeader;
function ImgOffset2SectionNum(dwOffset: DWORD): integer;
function AddNewSection(szName: string; dwSize: DWORD): PImageSectionHeader;
public
constructor Create;
destructor Destroy; override;
procedure OpenFile(filename : string);
procedure SaveFile(filename : string);
procedure CyrptFile;
end;
|
二、类代码
DelphiCode:
implementation
uses PEInit; //被用来插入的代码单元
const szWindowsAPIs : array[0..10] of string = ('Kernel32.dll',
'GetModuleHandleA',
'VirtualProtect',
'GetModuleFileNameA',
'CreateFileA',
'GlobalAlloc',
'',
'User32.dll',
'MessageBoxA',
'',
'');
const szIATEXEStrings : array[0..4] of string = ('Kernel32.dll',
'LoadLibraryA',
'GetProcAddress',
'',
'');
const szIATDLLStrings : array[0..29] of string = (
'Kernel32.dll',
'LoadLibraryA',
'GetProcAddress',
'GetModuleHandleA',
'',
'User32.dll',
'GetKeyboardType',
'WindowFromPoint',
'',
'AdvApi32.dll',
'RegQueryValueExA',
'RegSetValueExA',
'StartServiceA',
'',
'Oleaut32.dll',
'SysFreeString',
'CreateErrorInfo',
'SafeArrayPtrOfIndex',
'',
'Gdi32.dll',
'UnrealizeObject',
'',
'Ole32.dll',
'CreateStreamOnHGlobal',
'IsEqualGUID',
'',
'ComCtl32.dll',
'ImageList_SetIconSize',
'',
'');
constructor TPE.Create;
begin
dwDosStubSize := 0;
end;
destructor TPE.Destroy;
begin
end;
{实现File或Section对齐}
function TPE.PEAlign(dwTarNum: DWORD; dwAlignTo: DWORD): DWORD;
begin
result := ((dwTarNum + dwAlignTo - 1) div dwAlignTo) * dwAlignTo;
end;
{把所有的节进行Section对齐}
procedure TPE.AlignmentSections;
var
i : integer;
begin
for i:= 0 to imgNtHeaders.FileHeader.NumberOfSections - 1 do
begin
imgSectionHeaders[i].VirtualAddress := PEAlign(imgSectionHeaders[i].VirtualAddress, imgNtHeaders.OptionalHeader.SectionAlignment);
imgSectionHeaders[i].Misc.VirtualSize := PEAlign(imgSectionHeaders[i].Misc.VirtualSize, imgNtHeaders.OptionalHeader.SectionAlignment);
imgSectionHeaders[i].PointerToRawData := PEAlign(imgSectionHeaders[i].PointerToRawData, imgNtHeaders.OptionalHeader.FileAlignment);
imgSectionHeaders[i].SizeOfRawData := PEAlign(imgSectionHeaders[i].SizeOfRawData, imgNtHeaders.OptionalHeader.FileAlignment);
end;
imgNtHeaders.OptionalHeader.SizeOfImage := imgSectionHeaders[i-1].VirtualAddress + imgSectionHeaders[i-1].Misc.VirtualSize;
imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].VirtualAddress := 0;
imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].Size := 0;
imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress := 0;
imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size := 0;
imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress := 0;
imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size := 0;
end;
{找到内存中某一个RVA所映射的磁盘文件上的offset}
function TPE.RVA2Offset(dwRVA : DWORD): DWORD;
var
offset : DWORD;
section : PImageSectionHeader;
begin
section := ImgRVA2Section(dwRVA);
if section = nil then
result := 0
else
begin
offset := dwRVA + section.PointerToRawData - section.VirtualAddress;
result := offset;
end;
end;
{找到磁盘上某一个offset所映射的内存中的RVA}
function TPE.Offset2RVA(dwOffset : DWORD): DWORD;
var
section : PImageSectionHeader;
begin
section := ImgOffset2Section(dwOffset);
if section = nil then
result := 0
else
result := dwOffset + section.VirtualAddress - section.PointerToRawData;
end;
{返回PE文件加载到内存后，RVA地址所处的Section}
function TPE.imgRVA2Section(dwRVA : DWORD) : PImageSectionHeader;
var
i : integer;
begin
for i:= 0 to imgNtHeaders.FileHeader.NumberOfSections - 1 do
begin
if ((dwRVA >= imgSectionHeaders[i].VirtualAddress) and (dwRVA <= (imgSectionHeaders[i].VirtualAddress + imgSectionHeaders[i].SizeOfRawData))) then
begin
result := @imgSectionHeaders[i];
exit;
end;
end;
result := nil;
end;
{返回OFFSET地址在PE文件位于磁盘上的所落的Section}
function TPE.ImgOffset2Section(dwOffset : DWORD): PImageSectionHeader;
var
i: integer;
begin
for i:=0 to imgNtHeaders.FileHeader.NumberOfSections - 1 do
begin
if ((dwOffset >= imgSectionHeaders[i].PointerToRawData) and (dwOffset < (imgSectionHeaders[i].PointerToRawData + imgSectionHeaders[i].SizeOfRawData))) then
begin
result := @ImgSectionHeaders[i];
exit;
end;
end;
result := nil;
end;
{返回Offset地址在PE文件位于磁盘上所落Section的编号}
function TPE.ImgOffset2SectionNum(dwOffset : DWORD): integer;
var
i: integer;
begin
for i:=0 to imgNtHeaders.FileHeader.NumberOfSections - 1 do
begin
if ((dwOffset >= imgSectionHeaders[i].PointerToRawData) and (dwOffset < (imgSectionHeaders[i].PointerToRawData + imgSectionHeaders[i].SizeOfRawData))) then
begin
result := i;
exit;
end;
end;
result := -1;
end;
{增加一个新的Section,可读/写， 包含已初始化数据.}
function TPE.AddNewSection(szName: string; dwSize: DWORD): PImageSectionHeader;
var
i : integer;
roffset : DWORD;
rsize : DWORD;
voffset : DWORD;
vsize : DWORD;
begin
i := imgNtHeaders.FileHeader.NumberOfSections;
rsize := PEAlign(dwSize, imgNtHeaders.OptionalHeader.FileAlignment);
vsize := PEAlign(rsize, imgNtHeaders.OptionalHeader.SectionAlignment);
roffset := PEAlign(imgSectionHeaders[i-1].PointerToRawData + imgSectionHeaders[i-1].SizeOfRawData,
imgNtHeaders.OptionalHeader.FileAlignment);
voffset := PEAlign(imgSectionHeaders[i-1].VirtualAddress + imgSectionHeaders[i-1].Misc.VirtualSize,
imgNtHeaders.OptionalHeader.SectionAlignment);
FillChar(imgSectionHeaders[i],sizeof(TImageSectionHeader),#0);
imgSectionHeaders[i].PointerToRawData := roffset;
imgSectionHeaders[i].VirtualAddress := voffset;
imgSectionHeaders[i].SizeOfRawData := rsize;
imgSectionHeaders[i].Misc.VirtualSize := vsize;
imgSectionHeaders[i].Characteristics := $C0000040;
CopyMemory(@imgSectionHeaders[i].Name[0],@szName[1],length(szName));
imgSections[i] := Pointer(GLobalAlloc(GMEM_FIXED or GMEM_ZEROINIT,rsize));
imgNtHeaders.FileHeader.NumberOfSections := imgNtHeaders.FileHeader.NumberOfSections + 1;
result := @imgSectionHeaders[i];
end;
{打开一个PE文件，按其格式分部分读入}
procedure TPE.OpenFile(filename : string);
var
dwBytesRead : DWORD;
hFile : THANDLE;
sectionNum : DWORD;
i : integer;
firstSectionOffset : DWORD;
dwOffset : DWORD;
begin
pMem := nil;
hFile := CreateFile(PChar(filename),GENERIC_READ, FILE_SHARE_WRITE or FILE_SHARE_READ, nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL,0);
if hFile = INVALID_HANDLE_VALUE then
begin
exit;
end;
dwFileSize := GetFileSize(hFile,0);
if dwFileSize = 0 then
begin
CloseHandle(hFile);
exit;
end;
pMem := Pointer(GlobalAlloc(GMEM_FIXED or GMEM_ZEROINIT, dwFileSize));
if dwFileSize = 0 then
begin
CloseHandle(hFile);
exit;
end;
ReadFile(hFile,pMem^,dwFileSize,dwBytesRead,nil);
CloseHandle(hFile);
CopyMemory(@imgDosHeader,pMem,sizeof(IMAGE_DOS_HEADER));
dwDosStubSize := imgDosHeader._lfanew - sizeof(IMAGE_DOS_HEADER);
dwDosStubOffset := sizeof(IMAGE_DOS_HEADER);
getMem(pDosStub,dwDosStubSize);
if (dwDosStubSize and $80000000) = $00000000 then
begin
copyMemory(pDosStub,pointer(DWORD(pMem) + dwDosStubOffset), dwDosStubSize);
end;
copyMemory(@imgNtHeaders,pointer(DWORD(pMem)+imgDosHeader._lfanew),sizeof(IMAGE_NT_HEADERS));
firstSectionOffset := imgDosHeader._lfanew + sizeof(IMAGE_NT_HEADERS);
if imgDosHeader.e_magic <> IMAGE_DOS_SIGNATURE then
begin
GlobalFree(DWORD(pMem));
exit;
end;
SectionNum := imgNtHeaders.FileHeader.NumberOfSections;
for i:=0 to SectionNum -1 do
begin
CopyMemory(@imgSectionHeaders[i],pointer(DWORD(pMem)+ firstSectionOffset + i * sizeof(IMAGE_SECTION_HEADER)),sizeof(IMAGE_SECTION_HEADER));
end;
for i:=0 to SectionNum -1 do
begin
imgSections[i] := Pointer(GlobalAlloc(GMEM_FIXED or GMEM_ZEROINIT,PEAlign(imgSectionHeaders[i].SizeOfRawData,imgNtHeaders.OptionalHeader.FileAlignment)));
copyMemory(imgSections[i],pointer(DWORD(pMem)+imgSectionHeaders[i].PointerToRawData), imgSectionHeaders[i].SizeOfRawData);
end;
if imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress <> 0 then
begin
dwOffset := RVA2Offset(imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress);
copymemory(@imgTLSDirectory,pointer(DWORD(pMem) + dwOffset), sizeof(IMAGE_TLS_DIRECTORY32));
end;
GlobalFree(DWORD(pMem));
end;
procedure TPE.SaveFile(filename : string);
var
dwBytesWritten : DWORD;
i : integer;
dwRO_first_section : DWORD;
sectionNum : DWORD;
hFile : THANDLE;
begin
hFile := CreateFile(PChar(filename),GENERIC_WRITE, FILE_SHARE_WRITE or FILE_SHARE_READ, nil, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, 0);
if hFile = INVALID_HANDLE_VALUE then
begin
hFile := CreateFile(PChar(filename), GENERIC_WRITE, FILE_SHARE_WRITE or FILE_SHARE_READ, nil, CREATE_NEW, FILE_ATTRIBUTE_NORMAL,0);
if hFile = INVALID_HANDLE_VALUE then
exit;
end;
AlignmentSections;
i := imgNtHeaders.FileHeader.NumberOfSections;
dwFileSize := imgSectionHeaders[i-1].PointerToRawData + imgSectionHeaders[i-1].SizeOfRawData;
pMem := Pointer(GlobalAlloc(GMEM_FIXED or GMEM_ZEROINIT,dwFileSize));
if pMem = nil then
begin
CloseHandle(hFile);
exit;
end;
copyMemory(pMem,@imgDosHeader,sizeof(IMAGE_DOS_HEADER));
if (dwDOSStubSize and $80000000) = $00000000 then
copyMemory(pointer(DWORD(pMem) + dwDosStubOffset), pDosStub, dwDosStubSize);
copyMemory(pointer(DWORD(pMem)+imgDosHeader._lfanew), @imgNtHeaders, sizeof(IMAGE_NT_HEADERS));
dwRO_first_section := imgDosHeader._lfanew + sizeof(IMAGE_NT_HEADERS);
sectionNum := imgNtHeaders.FileHeader.NumberOfSections;
for i:=0 to SectionNum - 1 do
begin
CopyMemory(pointer(DWORD(pMem) + dwRO_first_Section + i * sizeof(IMAGE_SECTION_HEADER)), @imgSectionHeaders[i],sizeof(IMAGE_SECTION_HEADER));
end;
for i:=0 to SectionNum - 1 do
begin
CopyMemory(pointer(DWORD(pMem) + imgSectionHeaders[i].PointerToRawData), imgSections[i], ImgSectionHeaders[i].SizeOfRawData);
end;
SetFilePointer(hFile ,0, nil,FILE_BEGIN);
writeFile(hFile,pMem^,dwFileSize, dwBytesWritten,nil);
setFilePointer(hFile,dwFileSize, nil,FILE_BEGIN);
setEndOfFile(hFile);
CloseHandle(hFile);
GlobalFree(DWORD(pMem));
end;
{用来查找一段代码的标志位,在FuncCode指针开始的字符串中,查找一个DWORD的标志}
function TPE.ReturnToBytePtr(FuncCode : pointer; findstr : DWORD): pointer;
var
tmpd : Pointer;
begin
asm
pushad
mov eax, FuncCode
jmp @label1
@label0:
inc eax
@label1:
mov ebx, [eax]
cmp ebx, findstr
jnz @label0
mov tmpd, eax
popad
end;
result := tmpd;
end;
{把一段跳转指令加入到PE文件中,先建立一个新SECTION,然后把新输入表放入新区的 }
{ 起始地址,把一点代码放到输入表后.然后把跳转指令加入到新Section,跳回原来的程序,}
{同时使用新的输入表来取代旧的输入表 }
procedure TPE.CyrptFile;
var
ch_temp : Pointer;
i : DWORD;
imgSectionHeader : PImageSectionHeader;
dwNewSectionSize : DWORD;
dwCodeSize : DWORD;
dwCodeOffset : DWORD;
begin
if (imgNTHeaders.FileHeader.Characteristics and IMAGE_FILE_DLL) = IMAGE_FILE_DLL then
ITMaker := TImportTableMaker.Create(IMPORT_TABLE_DLL)
else
ITMaker := TImportTableMaker.Create(IMPORT_TABLE_EXE);
ch_temp := Pointer(DWORD(ReturnToBytePtr(@InitPE,DYN_LOADER_START_MAGIC)) +4);
dwCodeSize := DWORD(ReturnToBytePtr(@InitPE,DYN_LOADER_END_MAGIC)) - DWORD(ch_temp);
dwCodeOffset := ITMaker.dwSize;
dwNewSectionSize := dwCodeSize + ITMaker.dwSize;
getmem(pNewSection,dwNewSectionSize);
copymemory(Pointer(DWORD(pNewSection) + dwCodeOffset), ch_temp, dwCodeSize);
imgSectionHeader := AddNewSection('.xxx',dwNewSectionSize);
CopyData(imgSectionHeader.VirtualAddress);
ITMaker.Build(imgSectionHeader.VirtualAddress);
copyMemory(pNewSection,ITMaker.pMem, ITMaker.dwSize);
copymemory(imgSections[imgNtHeaders.FileHeader.NumberOfSections-1], pNewSection, dwNewSectionSize);
imgNtHeaders.OptionalHeader.AddressOfEntryPoint := imgSectionHeader.VirtualAddress + dwCodeOffset;
imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress := imgSectionHeader.VirtualAddress;
imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size := ITMaker.dwSize;
imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress := 0;
imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size := 0;
SetSectionsWritePermission;
freemem(pNewSection,dwNewSectionSize);
ITMaker.Free;
end;
procedure TPE.CopyData(dwVirtualAddress : DWORD);
var
i : integer;
APINum : integer;
pData : Pointer;
dwOffset : DWORD;
len : longint;
DataTable : TData;
temp : byte;
begin
DataTable.dwReserved1 := $CCCCCCCC;
if ((imgNtHeaders.FileHeader.Characteristics and IMAGE_FILE_DLL) = IMAGE_FILE_DLL) then
DataTable.dwFileType := IMPORT_TABLE_DLL
else
DataTable.dwFileType := IMPORT_TABLE_EXE;
DataTable.dwImageBase := imgNtHeaders.OptionalHeader.ImageBase;
DataTable.dwOrgEntryPoint := imgNtHeaders.OptionalHeader.AddressOfEntryPoint;
DataTable.dwImportVAddr := imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
if (imgNtHeaders.FileHeader.Characteristics and IMAGE_FILE_DLL) = IMAGE_FILE_DLL then
begin
DataTable.dwRelocationVAddr := imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress;
DataTable.dwRelocationSize := imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size;
end;
pData := ReturnToBytePtr(pNewSection, DYN_LOADER_START_DATA1);
if imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress <> 0 then
begin
CopyMemory(@DataTable.imgTLSDirectory,@imgTLSDirectory,sizeof(IMAGE_TLS_DIRECTORY32));
dwOffset := DWORD(pData) - DWORD(pNewSection);
dwOffset := dwOffset + sizeof(DataTable) - sizeof(IMAGE_TLS_DIRECTORY32);
imgNtHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress := dwVirtualAddress + dwOffset;
end;
CopyMemory(pData,@DataTable, sizeof(TData));
dwOffset := sizeof(TDATA);
i := 0; APINum := 0; temp := 0;
repeat
len := Length(szWindowsAPIs[i]) + 1;
CopyMemory(Pointer(DWORD(pData) + dwOffset),@szWindowsAPIs[i][1],len);
dwOffset := dwOffset + len;
repeat
i := i + 1;
if szWindowsAPIs[i] <> '' then
begin
len := length(szWindowsAPIs[i]) + 1;
CopyMemory(Pointer(DWORD(pData) + dwOffset), @szWindowsAPIs[i][1],len);
dwOffset := dwOffset + len;
APINum := APINum + 1;
end
else
begin
CopyMemory(Pointer(DWORD(pData) + dwOffset), @temp, 1);
dwOffset := dwOffset + 1;
end;
until szWindowsAPIs[i] = '';
i := i + 1;
until szWindowsAPIs[i] = '';
end;
procedure TPE.SetSectionsWritePermission;
var
i : integer;
begin
for i:=0 to imgNTHeaders.FileHeader.NumberOfSections - 1 do
imgSectionHeaders[i].Characteristics := $C0000040;
end;
{******************************************************************************}
constructor TImportTableMaker.Create(iType : integer);
begin
ImportTable := TList.Create;
init(iType);
dwSize := GetIATSize;
GetMem(pMem,dwSize);
end;
destructor TImportTableMaker.Destroy;
var
imgImport : PImageImport;
begin
while ImportTable.Count > 0 do
begin
imgImport := PImageImport(ImportTable.Items[0]);
while imgImport.ThunksList.Count > 0 do
begin
freeMem(imgImport.ThunksList.Items[0],32);
imgImport.ThunksList.Delete(0);
end;
imgImport.ThunksList.Free;
dispose(imgImport);
ImportTable.Delete(0);
end;
ImportTable.Free;
FreeMem(pMem,dwSize);
end;
procedure TImportTableMaker.Init(iType : integer);
var
i : integer;
IATString : pointer;
imgImport : PImageImport;
imgThunk : PChar;
function IsStringsEnd(inx : integer) : boolean;
begin
result := false;
case iType of
IMPORT_TABLE_EXE:
begin
if szIATEXEStrings[inx] = '' then
result := true;
end;
IMPORT_TABLE_DLL:
begin
if szIATDLLStrings[inx] = '' then
result := true;
end;
end;
end;
begin
i := 0;
repeat
New(imgImport);
imgImport.ThunksList := TList.Create;
case iType of
IMPORT_TABLE_EXE: copyMemory(@imgImport.szLibrary[0], @szIATEXEStrings[i][1],32);
IMPORT_TABLE_DLL: copyMemory(@imgImport.szLibrary[0], @szIATDLLStrings[i][1],32);
end;
repeat
i := i + 1;
if not IsStringsEnd(i) then
begin
getMem(imgThunk,32);
fillchar(imgTHunk^,32,#0);
case iType of
IMPORT_TABLE_EXE: copyMemory(imgThunk,@szIATEXEStrings[i][1],32);
IMPORT_TABLE_DLL: copyMemory(imgThunk,@szIATDLLStrings[i][1],32);
end;
imgImport.ThunksList.Add(imgThunk);
end;
until IsStringsEnd(i);
ImportTable.Add(imgImport);
i := i + 1;
until IsStringsEnd(i);
end;
function TImportTableMaker.GetIATSize : DWORD;
var
i : integer;
j : integer;
dwDLLNum : DWORD;
dwFuncNum : DWORD;
dwszDLLSize : DWORD;
dwszFuncSize : DWORD;
dwImportSize : DWORD;
imgImport : PImageImport;
begin
dwDLLNum := 0; dwFuncNum := 0; dwszDLLSize := 0; dwszFuncSize := 0; dwImportSize := 0;
for i:= 0 to ImportTable.Count - 1 do
begin
imgImport := ImportTable.Items[i];
dwszDLLSize := dwszDLLSize + strlen(imgimport.szLibrary) + 1;
for j:=0 to imgImport.ThunksList.Count - 1 do
begin
dwszFuncSize := dwszFuncSize + 2 + strlen(PChar(imgimport.ThunksList.Items[j])) + 1;
dwFuncNum := dwFuncNum + 1;
end;
dwFuncNum := dwFuncNum + 1;
dwDLLNum := dwDLLNum + 1;
end;
dwDLLNum := dwDLLNum + 1;
dwImportSize := dwDLLnum * 20 + dwFuncNum * 4 + dwSzDLLSize + dwszFuncSize;
result := dwImportSize;
end;
procedure TImportTableMaker.Build(baseRVA : DWORD);
var
i : integer;
j : integer;
pITBaseRVA : DWORD;
temp : DWORD;
dwDLLNum : DWORD;
dwDLLName : DWORD;
dwDLLFirst : DWORD;
dwszDLLSize : DWORD;
dwIIDNum : DWORD;
dwFunNum : DWORD;
dwFunFirst : DWORD;
dwszFuncSize : DWORD;
dwFirstThunk : DWORD;
dwImportSize : DWORD;
imgImport : PImageImport;
importDesc : TImageImportDecriptor;
begin
pITBaseRVA := baseRVA;
importDesc.Union.OriginalFirstThunk := 0;
importDesc.TimeDateStamp := 0;
importDesc.ForwarderChain := 0;
importDesc.Name := 0;
importDesc.FirstThunk := 0;
dwDLLNum := 0; dwDLLName := 0; dwDLLFirst := 0; dwszDLLSize := 0;
dwIIDNum := 0; dwFunNum := 0; dwFunFirst := 0; dwszFuncSize := 0;
dwFirstThunk := 0; dwImportSize := 0;
for i:= 0 to importTable.Count -1 do
begin
imgImport := PImageImport(importTable.Items[i]);
dwszDLLSize := dwszDLLSize + strlen(imgImport.szLibrary) + 1;
for j:= 0 to imgImport.ThunksList.Count - 1 do
begin
dwszFuncSize := dwszFuncSize + 2 + strlen(PChar(imgImport.ThunksList.Items[j])) + 1;
dwFunNum := dwFunNum + 1;
end;
dwFunNum := dwFunNum + 1;
dwDLLNum := dwDLLNum + 1;
end;
dwDLLNum := dwDLLNum + 1;
dwImportSize := dwDLLNum * 20 + dwFunNum * 4 + dwszDLLSize + dwszFuncSize;
FillMemory(pMem,dwImportSize, 0);
dwFirstThunk := dwDLLNum * 20;
dwDLLFirst := dwDLLNum * 20 + dwFunNum * 4;
dwFunFirst := dwDLLNum * 20 + dwFunNum * 4 + dwszDLLSize;
for i := 0 to importTable.Count - 1 do
begin
imgImport := importTable.Items[i];
importDesc.Name := pITBaseRVA + dwDLLFirst;
importDesc.FirstThunk := pITBaseRVA + dwFirstThunk;
CopyMemory(Pointer(DWORD(pMem) + dwIIDNum * sizeof(IMAGE_IMPORT_DESCRIPTOR)),@importDesc,sizeof(IMAGE_IMPORT_DESCRIPTOR));
CopyMemory(Pointer(DWORD(pMem) + dwDLLFirst),@imgImport.szLibrary[0],strlen(imgImport.szLibrary) + 1);
for j:=0 to imgimport.ThunksList.Count - 1 do
begin
temp := pITBaseRVA + dwFunFirst;
CopyMemory(Pointer(DWORD(pMem) + dwFirstThunk),@temp,4);
CopyMemory(Pointer(DWORD(pMem) + dwFunFirst + 2), PChar(imgImport.ThunksList.Items[j]),strlen(imgImport.ThunksList.Items[j]) + 1);
dwFunFirst := dwFunFirst + 2 + strlen(imgImport.ThunksList.Items[j]) + 1;
dwFirstThunk := dwFirstThunk + 4;
end;
temp := 0;
CopyMemory(Pointer(DWORD(pMem) + dwFirstThunk),@temp, 4);
dwFirstThunk := dwFirstTHunk + 4;
dwDLLFirst := dwDLLFirst + strlen(imgImport.szLibrary) + 1;
dwIIDNum := dwIIDNum + 1;
end;
importDesc.Name := 0;
importDesc.FirstThunk := 0;
CopyMemory(Pointer(DWORD(pMem)+dwIIDNum * sizeof(IMAGE_IMPORT_DESCRIPTOR)), @importDesc,sizeof(IMAGE_IMPORT_DESCRIPTOR));
end;
end.
{************************************************************************************************************}
PEint单元
unit PEInit;
interface
uses windows;
procedure InitPE; stdcall;
implementation
{一段要嵌入到PE文件中的指令}
{标志位的作用是用来找到找到从开始标志位后到结束标志位之间的指令大小及开始地址}
{这段代码如果用在VC中,则要设置链接选项/INCREMENTAL LINK OFF}
procedure InitPE; stdcall;
begin
asm
{开始标志位}
DB $A9 DB $51 DB $DE DB $C0
@Main_0:
pushad;
call @Main_1
@Main_1:
pop ebp
sub ebp, offset @main_1
{**********************支持DLL，OCX等****************************************}
@_support_dll_0:
jmp @_support_dll_1 {// nop; nop; // in the secon time OEP 第一次加载后，}
{这句会被改成 nop; nop；在DLL被卸载的时候，会直接调用jmp @_support_dll_2}
jmp @_support_dll_2
@_support_dll_1:
test [ebp + @_p_dwFileType],0001h // IMPORT_TABLE_DLL
jz @_no_dll_pe_file_0
mov eax,[esp+24h]
mov ebx,[esp+34h]
cmp eax,ebx
ja @_no_dll_pe_file_0
cmp word ptr [eax], IMAGE_DOS_SIGNATURE
jne @_no_dll_pe_file_0
mov [ebp + @_RO_dwImageBase],eax
@_no_dll_pe_file_0:
// 获取输入表中的LoadLibrary 和 GetProcAddress来建立函数跳转表
mov eax, DWORD PTR [ebp + @_RO_dwImageBase]
add eax, [eax + 03Ch]
add eax, 080h
mov ecx, [eax]
add ecx, [ebp + @_RO_dwImageBase]
add ecx, 010h
mov eax, [ecx]
add eax, [ebp + @_RO_dwImageBase]
mov ebx, [eax]
mov [ebp + @_p_LoadLibrary],ebx
add eax, 04h
mov ebx, [eax]
mov [ebp + @_p_GetProcAddress], ebx
call @_api_load // 加载插入功能代码所需要的DLL和函数跳转表
//***************************功能性代码***************************************
push MB_OK or MB_ICONINFORMATION
lea eax,[ebp + @_p_szCaption]
push eax
lea eax,[ebp + @_p_szText]
push eax
push 0000h
call @_jmp_MessageBox
//****************************************************************************
{将在内存中的PE文件的NTHeader头改为可读写}
mov edi, [ebp + @_RO_dwImageBase]
add edi, [edi + 03Ch]
lea eax, [ebp + @_p_ptempbuffer]
push eax
push PAGE_READWRITE
push [edi + 54h]
push [ebp + @_RO_dwImageBase]
call @_jmp_VirtualProtect
call @_it_fixup // 为被插入的程序建立内存中的输入表
{判断是否是DLL}
mov edi,[ebp + @_RO_dwImageBase]
add edi,[edi+03Ch]
mov ax,word ptr [edi+016h]
test ax,IMAGE_FILE_DLL
jz @_no_dll_pe_file_1
call @_reloc_fixup // 为被捆绑的程序修正重定位表.因为EXE一般不需要，只在DLL的时候需要。
mov ax,9090h // 为DLL建立卸载时候的入口点
mov word ptr [ebp + @_support_dll_0],ax
@_no_dll_pe_file_1:
@_support_dll_2:
//--------- 利用SEH异常转入程序入口点 ---------
mov eax, [ebp + @_RO_dwImageBase]
add eax, DWORD PTR [ebp + @_RO_dwOrgEntryPoint]
mov DWORD PTR [esp + 10h], eax
lea eax, [ebp + @_except_handler1_oep_jump]
mov DWORD PTR [esp + 1ch],eax
popad
push eax
xor eax,eax
push DWORD PTR FS:[0]
mov DWORD PTR FS:[0], ESP
{注册完异常处理回调函数，开始调用INT 3 触发异常,异常发生后，}
{线程的栈被保护起来，原来存有真正OEP地址的EBX也被保存起来}
DB $CC
DB $CC
DB $CC
DB $CC
{eax中返回字符串的长度}
@_strlen:
push ebp
mov ebp,esp
push ecx
push esi
push ebx
mov esi,[ebp+08h]
mov ecx,255// -> Length
xor ebx,ebx
@_strlenloop:
lods byte ptr ds:[esi]
cmp al,00h
jz @_endbufstrlen
inc ebx
loop @_strlenloop
@_endbufstrlen:
mov eax,ebx
inc eax
pop ebx
pop esi
pop ecx
mov esp,ebp
pop ebp
ret
{*********************为被插入代码的程序修正重定位表*******************************}
@_reloc_fixup:
mov eax,[ebp + @_RO_dwImageBase]
mov edx,eax
mov ebx,eax
add ebx,[ebx+3Ch]
mov ebx,[ebx+034h]
sub edx,ebx
je @_reloc_fixup_end
mov ebx,[ebp + @_p_dwRelocationVirtualAddress]
test ebx,ebx
jz @_reloc_fixup_end
add ebx,eax
@_reloc_fixup_block:
mov eax,[ebx+004h]
test eax,eax
jz @_reloc_fixup_end
lea ecx,[eax-008h]
shr ecx,001h
lea edi,[ebx+008h]
@_reloc_fixup_do_entry:
movzx eax,word ptr [edi]
push edx
mov edx,eax
shr eax,00Ch
mov esi,[ebp + @_RO_dwImageBase]
and dx,00FFFh
add esi,[ebx]
add esi,edx
pop edx
@_reloc_fixup_HIGH:
dec eax
jnz @_reloc_fixup_LOW
mov eax,edx
shr eax,010h //HIWORD(Delta)
jmp @_reloc_fixup_LOW_fixup
@_reloc_fixup_LOW:
dec eax
jnz @_reloc_fixup_HIGHLOW
movzx eax,dx //LOWORD(Delta)
@_reloc_fixup_LOW_fixup:
add word ptr [esi],ax
jmp @_reloc_fixup_next_entry
@_reloc_fixup_HIGHLOW:
dec eax
jnz @_reloc_fixup_next_entry
add [esi],edx
@_reloc_fixup_next_entry:
inc edi
inc edi //Entry++
loop @_reloc_fixup_do_entry
@_reloc_fixup_next_base:
add ebx,[ebx+004h] //ImageBaseRelocation + ImageBaseRelocation.SizeOfBlock
jmp @_reloc_fixup_block
@_reloc_fixup_end:
ret
{**************为捆绑的程序在内存中建立IAT表*********************************}
{1. 加载输入表中对应的DLL。 }
{2. 加载输入表里对应DLL的输入函数。 }
{3. 讲函数的内存地址放入输入表的FirstThunk里，建立IAT表 }
@_it_fixup:
mov ebx,[ebp + @_p_dwImportVirtualAddress]
test ebx,ebx
jz @_it_fixup_end
mov esi,[ebp + @_RO_dwImageBase]
add ebx,esi
@_it_fixup_get_lib_address_loop:
mov eax,[ebx+00Ch]
test eax,eax
jz @_it_fixup_end
mov ecx,[ebx+010h]
add ecx,esi
mov [ebp + @_p_dwThunk],ecx
mov ecx,[ebx]
test ecx,ecx
jnz @_it_fixup_table
mov ecx,[ebx + 010h]
@_it_fixup_table:
add ecx,esi
mov [ebp + @_p_dwHintName],ecx
add eax,esi
push eax
mov eax,offset @_p_LoadLibrary
call [ebp+eax]
test eax,eax
jz @_it_fixup_end
mov edi,eax
@_it_fixup_get_proc_address_loop:
mov ecx,[ebp + @_p_dwHintName]
mov edx,[ecx]
test edx,edx
jz @_it_fixup_next_module
test edx,80000000h
jz @_it_fixup_by_name
and edx,07FFFFFFFh
jmp @_it_fixup_get_addr
@_it_fixup_by_name:
add edx,esi
inc edx
inc edx
@_it_fixup_get_addr:
push edx
push edi
mov eax,offset @_p_GetProcAddress
call [ebp+eax]
mov ecx,[ebp + @_p_dwThunk]
mov [ecx],eax
add dword ptr [ebp + @_p_dwThunk],004h
add dword ptr [ebp + @_p_dwHintName],004h
jmp @_it_fixup_get_proc_address_loop
@_it_fixup_next_module:
add ebx,014h
jmp @_it_fixup_get_lib_address_loop
@_it_fixup_end:
ret
{***************加载动态库，然后建立其输入函数的跳转表***********************}
@_api_load:
lea edi, [ebp + @_p_szKernel32]
lea ebx, [ebp + @_p_GetModuleHandle]
lea ecx, [ebp + @_jmp_GetModuleHandle]
add ecx, 02h
@_api_get_lib_address_loop:
push ecx
push edi
mov eax, offset @_p_LoadLibrary
call [ebp + eax]
pop ecx
mov esi, eax
push edi
call @_strlen
add esp, 04h
add edi, eax
@_api_get_proc_address_loop:
push ecx
push edi
push esi
mov eax, offset @_p_GetProcAddress
call [ebp + eax]
pop ecx
mov [ebx], eax
mov [ecx], ebx
add ebx, 04h
add ecx, 06h
push edi
call @_strlen
add esp, 04h
add edi, eax
mov al, byte ptr [edi]
test al,al
jnz @_api_get_proc_address_loop
inc edi
mov al, byte ptr [edi]
test al, al
jnz @_api_get_lib_address_loop
ret
{SEH异常处理回调函数的有四个参数，分别为ExceptionRecord, SEH, Context, }
{DispatcherContext,先压入下一个指令的地址，然后根据被压入栈的这四个参数中 }
{Context的
|
四、测试。
可以对EXE文件和DLL文件进行代码插入。当被插入的EXE文件或DLL文件运行或被调用的时候，都会先跳出一个对话框：
然后再运行或调用被插入的EXE或DLL文件。
http://blog.csdn.net/suiyunonghen/article/details/3860206
