PE区段添加编写中的一点心得~

为PE区段的加区段，修改PE头的映像大小= =

代码如下：

BOOL LPESection::AddSection(char *pSectionName, DWORD &dwSectionSize,DWORD dwSectionStact)

{

LPVOID lPointer=NULL;

PBYTE pData=NULL;

DWORD newSectionAddr=0;

if (!IsPEFile())

{

return FALSE;

}

PIMAGE_NT_HEADERS pNTHdr=GetNtHeader();

//是否有足够空间容纳节头

if ((pNTHdr->FileHeader.NumberOfSections+1)*sizeof(IMAGE_SECTION_HEADER)>pNTHdr->OptionalHeader.SizeOfHeaders)

{

return FALSE;

}

//对齐数据

DWORD uCodeDelta=ZALIGN(dwSectionSize,pNTHdr->OptionalHeader.SectionAlignment);

DWORD uFileDelta=ZALIGN(dwSectionSize,pNTHdr->OptionalHeader.FileAlignment);

PIMAGE_SECTION_HEADER pNewSec=(PIMAGE_SECTION_HEADER)(pNTHdr+1)+pNTHdr->FileHeader.NumberOfSections;

PIMAGE_SECTION_HEADER pLaseSec=pNewSec-1;

//----------为将要创建的节赋值----------

strcpy((char*)pNewSec->Name,pSectionName);

pNewSec->VirtualAddress=pLaseSec->VirtualAddress+ZALIGN(pLaseSec->Misc.VirtualSize,pNTHdr->OptionalHeader.SectionAlignment);

newSectionAddr=pNewSec->PointerToRawData=pLaseSec->PointerToRawData+pLaseSec->SizeOfRawData;

pNewSec->Misc.VirtualSize=dwSectionSize;

pNewSec->SizeOfRawData=uFileDelta;

pNewSec->Characteristics=dwSectionStact;

//-------PE头的一些设置-----------------

pNTHdr->FileHeader.NumberOfSections++;

pNTHdr->OptionalHeader.SizeOfCode+=uFileDelta;

pNTHdr->OptionalHeader.SizeOfImage+=uCodeDelta;

pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size=0;

pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress=0;

dwSectionSize=uFileDelta;

//改变自身数据

DWORD dwOldSize=pstMapFile->dwFileSize;

pstMapFile->dwFileSize+=dwSectionSize;

UnmapViewOfFile(pstMapFile->hMapping);

CloseHandle(pstMapFile->hMapping);

pstMapFile->hMapping=CreateFileMapping(pstMapFile->hFile,NULL,PAGE_READWRITE,0,pstMapFile->dwFileSize,NULL);

pstMapFile->ImageBase=MapViewOfFile(pstMapFile->hMapping,FILE_MAP_ALL_ACCESS,0,0,pstMapFile->dwFileSize);

return TRUE;

}

pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size=0;

pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress=0;

上面这两行是平常在其他加区段的代码中不常见的，比如zapline的添加区段代码。如果没有上面这两句，那么对一些有bound iat的程序加壳后不能运行。原因

是IMAGE_BOUND_IMPORT_DESCTIPTOR结构中的OffsetModuleName变量存放的是与第一个IBID结构之间的偏移(不是RVA)。当你加了个新区段后，这个偏

移改变了，所以加壳就失败了~~