PE之合并节(5)

源码GitHub：https://github.com/TL-SN/_TLSN_RES.PE

一、

部分关键代码：(考虑篇幅，这里只贴了部分代码，全部代码都在GitHub上或者 https://www.cnblogs.com/lordtianqiyi/articles/15782773.html)

VOID _PE_User::RelCombineSection(LPVOID *pImageBuffer)
{
    LPVOID pTempImageBuffer;
    PE_S PeTmp_s;
    DWORD AllChara;
    
    AllChara = 0;
    pTempImageBuffer = malloc(pOptHeaderSizeOfImage);
    memset(pTempImageBuffer,pOptHeaderSizeOfImage,0);
    memcpy(pTempImageBuffer,*pImageBuffer,pOptHeaderSizeOfImage);

    conBuffToAddr(PeTmp_s,pTempImageBuffer);
    
    PeTmp_s.pSectionHeader->Misc.VirtualSize = cmp((PeTmp_s.pSectionHeader + PeTmp_s.pPEHeader->NumberOfSections - 1)->VirtualAddress + (PeTmp_s.pSectionHeader + PeTmp_s.pPEHeader->NumberOfSections - 1)->Misc.VirtualSize,(PeTmp_s.pSectionHeader + PeTmp_s.pPEHeader->NumberOfSections - 1)->VirtualAddress + (PeTmp_s.pSectionHeader + PeTmp_s.pPEHeader->NumberOfSections - 1)->SizeOfRawData) - PeTmp_s.pOptionHeader->SizeOfHeaders;
    PeTmp_s.pSectionHeader->SizeOfRawData = PeTmp_s.pSectionHeader->Misc.VirtualSize;

    for(int i = 0;i < PeTmp_s.pPEHeader->NumberOfSections;i++,(PeTmp_s.pSectionHeader)++) AllChara |= PeTmp_s.pSectionHeader->Characteristics;

    for(int j = 0;j < PeTmp_s.pPEHeader->NumberOfSections;j++) (PeTmp_s.pSectionHeader)--;
    
    PeTmp_s.pSectionHeader->Characteristics = AllChara;
    PeTmp_s.pPEHeader->NumberOfSections = 1;

    conBuffToAddr(File_PE_s,pTempImageBuffer);
    *pImageBuffer = pTempImageBuffer;


}

二、合并成一个节，飞鸽2007能正常运行

__EOF__

本文作者：_TLSN
本文链接：https://www.cnblogs.com/lordtianqiyi/articles/15782463.html
关于博主：评论和私信会在第一时间回复。或者直接私信我。
版权声明：本博客所有文章除特别声明外，均采用 BY-NC-SA 许可协议。转载请注明出处！
声援博主：如果您觉得文章对您有帮助，可以点击文章右下角【推荐】一下。您的鼓励是博主的最大动力！