PE之写入导入表注入(11)

源码GitHub：https://github.com/TL-SN/_TLSN_RES.PE

一、

部分关键代码：(考虑篇幅，这里只贴了部分代码，全部代码都在GitHub上 或者 https://www.cnblogs.com/lordtianqiyi/articles/15782773.html)

VOID _PE_User::RelInjectImportTable(LPVOID* pFileBuffer,size_t expand)
{
        DWORD UseAddr;
        DWORD SizeOfImport;
        PIMAGE_IMPORT_DESCRIPTOR pImportDescr;    //添加表的位置//
        PIMAGE_IMPORT_BY_NAME pImportByName;
    
        RelAddSectionHeader(pFileBuffer, expand);    //这里我直接使用的新增节//
        
        SizeOfImport = File_PE_s.pDataDirectory[1].Size - sizeof(IMAGE_IMPORT_DESCRIPTOR);
            
        memcpy( (void*)((DWORD)*pFileBuffer + (File_PE_s.pSectionHeader +  File_PE_s.pPEHeader->NumberOfSections - 1)->PointerToRawData), (void *)((DWORD)*pFileBuffer + RvaToFileOffset(File_PE_s.pDataDirectory[1].VirtualAddress)) , SizeOfImport);//1
        memcpy( (void*)((DWORD)*pFileBuffer + SizeOfImport + (File_PE_s.pSectionHeader +  File_PE_s.pPEHeader->NumberOfSections - 1)->PointerToRawData), (void *)((DWORD)*pFileBuffer + RvaToFileOffset(File_PE_s.pDataDirectory[1].VirtualAddress)) ,sizeof(IMAGE_IMPORT_DESCRIPTOR) );
        memset( (void*)((DWORD)*pFileBuffer + SizeOfImport + sizeof(IMAGE_IMPORT_DESCRIPTOR) + (File_PE_s.pSectionHeader +  File_PE_s.pPEHeader->NumberOfSections - 1)->PointerToRawData)  , 0 , sizeof(IMAGE_IMPORT_DESCRIPTOR));

        pImportDescr = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)*pFileBuffer + SizeOfImport + (File_PE_s.pSectionHeader +  File_PE_s.pPEHeader->NumberOfSections - 1)->PointerToRawData);
        pImportByName = (PIMAGE_IMPORT_BY_NAME)((DWORD)pImportDescr + 2 * sizeof(IMAGE_IMPORT_DESCRIPTOR) + 4 * sizeof(IMAGE_THUNK_DATA32));
        
        *(PDWORD)((DWORD)pImportDescr + 2*sizeof(IMAGE_IMPORT_DESCRIPTOR)) = SizeOfImport + (File_PE_s.pSectionHeader +  File_PE_s.pPEHeader->NumberOfSections - 1)->VirtualAddress + 2 * sizeof(IMAGE_IMPORT_DESCRIPTOR) + 4 * sizeof(IMAGE_THUNK_DATA32);    //INT// 保存的地址是RVA//
        *(PDWORD)((DWORD)pImportDescr + 2*sizeof(IMAGE_IMPORT_DESCRIPTOR) + sizeof(IMAGE_THUNK_DATA32)) = 0x0;
        *(PDWORD)((DWORD)pImportDescr + 2*sizeof(IMAGE_IMPORT_DESCRIPTOR) + sizeof(IMAGE_THUNK_DATA32) + sizeof(IMAGE_THUNK_DATA32)) = SizeOfImport + (File_PE_s.pSectionHeader +  File_PE_s.pPEHeader->NumberOfSections - 1)->VirtualAddress +2 * sizeof(IMAGE_IMPORT_DESCRIPTOR) + 4 * sizeof(IMAGE_THUNK_DATA32);  //IAT//
        *(PDWORD)((DWORD)pImportDescr + 2*sizeof(IMAGE_IMPORT_DESCRIPTOR) + sizeof(IMAGE_THUNK_DATA32) + sizeof(IMAGE_THUNK_DATA32) + sizeof(IMAGE_THUNK_DATA32)) = 0x0;
        
        pImportByName->Hint = 0x666;
        strcpy((char *)&pImportByName->Name[0] ,"_TLSN_Load_PE");
        pImportByName->Name[strlen("_TLSN_Load_PE")] = '\0';

        strcpy((char *)((DWORD)pImportByName + strlen("_TLSN_Load_PE") + 0x2 + 0x1),"_TLSN.dll");  //0x1是'\0'//
        pImportDescr->Name = SizeOfImport +  2*sizeof(IMAGE_IMPORT_DESCRIPTOR) + 4 * sizeof(IMAGE_THUNK_DATA32) + (File_PE_s.pSectionHeader +  File_PE_s.pPEHeader->NumberOfSections - 1)->VirtualAddress + strlen("_TLSN_Load_PE") + 0x2 + 0x1;
        pImportDescr->OriginalFirstThunk = (File_PE_s.pSectionHeader +  File_PE_s.pPEHeader->NumberOfSections - 1)->VirtualAddress + SizeOfImport +  2*sizeof(IMAGE_IMPORT_DESCRIPTOR);
        pImportDescr->FirstThunk = (File_PE_s.pSectionHeader +  File_PE_s.pPEHeader->NumberOfSections - 1)->VirtualAddress + SizeOfImport +  2*sizeof(IMAGE_IMPORT_DESCRIPTOR) + 2 * sizeof(IMAGE_THUNK_DATA32);
        

        File_PE_s.pDataDirectory[1].VirtualAddress = (File_PE_s.pSectionHeader +  File_PE_s.pPEHeader->NumberOfSections - 1)->VirtualAddress;
        File_PE_s.pDataDirectory[1].Size = SizeOfImport + 2*sizeof(IMAGE_IMPORT_DESCRIPTOR);
        
        conBuffToAddr(File_PE_s,*pFileBuffer);
        UseAddr = 0;
        UseAddr =  SizeOfImport + 2*sizeof(IMAGE_IMPORT_DESCRIPTOR) + sizeof(IMAGE_THUNK_DATA32) * 4 + strlen("_TLSN_Load_PE") + 0x2 + 0x1 + strlen("_TLSN.dll") + 0x1;
        printf("一共需要 %x 个字节\n",UseAddr);
}

二、

1.注入后用16进制文本编辑工具打开:

 

_TLSN.dll是我注入的dll, _TLSN_LOAD_PE是dll中的函数

2.用LoadPE解析:

 

可以发现成功解析

 3.双击运行:

 

 _TLSN.dll是我虚构出来的dll,我电脑上并没有这个dll,所以这个程序找不到...

 

__EOF__

本文作者：_TLSN
本文链接：https://www.cnblogs.com/lordtianqiyi/articles/15782658.html
关于博主：评论和私信会在第一时间回复。或者直接私信我。
版权声明：本博客所有文章除特别声明外，均采用 BY-NC-SA 许可协议。转载请注明出处！
声援博主：如果您觉得文章对您有帮助，可以点击文章右下角【推荐】一下。您的鼓励是博主的最大动力！