PE之存盘(1)

源码GitHub：https://github.com/TL-SN/_TLSN_RES.PE

一、

部分关键代码：(考虑篇幅，这里只贴了部分代码，剩下的代码都在GitHub上)

//把文件读到缓冲区//
VOID _PE::ReadPEFile(LPVOID* pFileBuffer)
{
    LPVOID pTempFileBuffer = NULL;
    FILE* fp = fopen(Path,"rb");

    if(!fp)
    {
        printf("fopen Error!!!\n");
        fclose(fp);
        return ;
    }

    fseek(fp,0,SEEK_END);    //SEEK_END : 使指针指向文件的末尾//
    lenFile = ftell(fp);    //回给定流stream的当前文件位置//
    fseek(fp,0,SEEK_SET);
    
    pTempFileBuffer = malloc(lenFile);
    if(!pTempFileBuffer)
    {
        printf("pTempFileBuffer，malloc失败!!!\n");
        free(pTempFileBuffer);
        fclose(fp);
        return ;
    }

    memset(pTempFileBuffer,0,lenFile);
    fread(pTempFileBuffer,1,lenFile,fp);

    *pFileBuffer = pTempFileBuffer;
    pTempFileBuffer = NULL;

    fclose(fp);
    cout<<"File的长度为："<<lenFile<<endl;
}

//拉伸//
VOID _PE::CopyFileBufferToImageBuffer(IN LPVOID pFileBuffer,OUT LPVOID* pImageBuffer)
{
    LPVOID pTempImagebufferr = NULL;


    conBuffToAddr(File_PE_s,pFileBuffer);

    pTempImagebufferr=malloc(File_PE_s.pOptionHeader->SizeOfImage);

    if(!pTempImagebufferr)
    {
        printf("pTempImagebufferr malloc 2\n");
        free(pFileBuffer);

        return ;
    }

    memset(pTempImagebufferr,0,File_PE_s.pOptionHeader->SizeOfImage);
    memcpy(pTempImagebufferr,File_PE_s.pDosHeader,File_PE_s.pOptionHeader->SizeOfHeaders);

    for(int i = 0;i < File_PE_s.pPEHeader->NumberOfSections;i++,(File_PE_s.pSectionHeader)++ )
    {
        memcpy((LPVOID)((DWORD)pTempImagebufferr + File_PE_s.pSectionHeader->VirtualAddress),(LPVOID)((DWORD)pFileBuffer + File_PE_s.pSectionHeader->PointerToRawData),File_PE_s.pSectionHeader->SizeOfRawData);
    }
    
    for(int j = 0;j < File_PE_s.pPEHeader->NumberOfSections; j++)
    {
        (File_PE_s.pSectionHeader)--;
    }//恢复第0个节表//
    
    *pImageBuffer=pTempImagebufferr;
    pTempImagebufferr = NULL;

    pOptHeaderSizeOfImage = File_PE_s.pOptionHeader->SizeOfImage;
    
    cout<<"pOptHeaderSizeOfImage : "<<pOptHeaderSizeOfImage<<endl;
    return ;
}

//压缩//
VOID _PE::CopyImageBufferToNewBuffer(IN LPVOID pImageBuffer,OUT LPVOID* pNewBuffer)
{
    LPVOID pTempImagebufferr = NULL;

    size_of_new_buffer = File_PE_s.pOptionHeader->SizeOfHeaders;
    
    for(size_t i = 0;i<File_PE_s.pPEHeader->NumberOfSections;i++)
    {
        size_of_new_buffer += (File_PE_s.pSectionHeader + i)->SizeOfRawData;
    }
    
    pTempImagebufferr = malloc(size_of_new_buffer);

    if(!pTempImagebufferr)
    {
        printf("malloc Error 3\n");
        free(pImageBuffer);
        
        return ;
    }

    memset(pTempImagebufferr,0,File_PE_s.pOptionHeader->SizeOfHeaders);
    memcpy(pTempImagebufferr,pImageBuffer,File_PE_s.pOptionHeader->SizeOfHeaders);

    for(DWORD j = 0;j < File_PE_s.pPEHeader->NumberOfSections ; j++,(File_PE_s.pSectionHeader)++)
    {
        memcpy((void*)((DWORD)pTempImagebufferr+File_PE_s.pSectionHeader->PointerToRawData),(void*)((DWORD)pImageBuffer+File_PE_s.pSectionHeader->VirtualAddress),File_PE_s.pSectionHeader->SizeOfRawData);
    }
    
    for(int k = 0;k < File_PE_s.pPEHeader->NumberOfSections; k++)
    {
        (File_PE_s.pSectionHeader)--;
    }

    *pNewBuffer=pTempImagebufferr;
    pTempImagebufferr=NULL;

    cout<<"size_of_new_buffer : "<<size_of_new_buffer<<endl;

    cout<<"pSectionHeader->Misc.VirtualSize : "<<hex<<File_PE_s.pSectionHeader->Misc.VirtualSize<<endl;

}
//存盘//
VOID _PE::MemeryTOFile(IN LPVOID pMemBuffer)
{
    FILE* Fb=fopen(lpszPath,"wb");

    if(!Fb)
    {
        printf("fopen Error 2!!!\n");
        fclose(Fb);
        free(pMemBuffer);

        
    }
    fwrite(pMemBuffer,1,size_of_new_buffer,Fb);
    
    fclose(Fb);
    free(pMemBuffer);

    return ;
}

//封装//
VOID _PE::FiToViToFi()
{
    PVOID pImageBuffer = NULL;
    PVOID pNewBuffer = NULL;
    PVOID pFileBuffer=NULL;

    ReadPEFile(&pFileBuffer);

    CopyFileBufferToImageBuffer(pFileBuffer,&pImageBuffer);

    CopyImageBufferToNewBuffer(pImageBuffer,&pNewBuffer);
    
    MemeryTOFile(pNewBuffer);

}

二、结果：

 

三、在进行验证的时候，我发现了一个有趣的问题，当我用win10系统下的记事本做实验的时候，我用自己的代码和PETOOL查看 pDosHeader->e_lfanew的值都是100

 

 

但当我用16进制查看工具WinHex查看的时候，却发现，这个值其实是F8:

 

 

我又试了试其他的可执行文件，发现WinHex与PETOOL的 e_lfanew 值都相同，唯独这个记事本不一样...

__EOF__

本文作者：_TLSN
本文链接：https://www.cnblogs.com/lordtianqiyi/articles/15758738.html
关于博主：评论和私信会在第一时间回复。或者直接私信我。
版权声明：本博客所有文章除特别声明外，均采用 BY-NC-SA 许可协议。转载请注明出处！
声援博主：如果您觉得文章对您有帮助，可以点击文章右下角【推荐】一下。您的鼓励是博主的最大动力！