PE文件相关代码

;WIN32汇编无输入表调用API

.386
.model flat,stdcall
option casemap:none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Include 文件定义
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include		windows.inc

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 数据段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.const

szCaption	db	'恭喜',0
szText		db	'非导入表调用成功!',0
szLoadLibrary	db	'LoadLibraryA',0
szGetProcAddress db	'GetProcAddress',0
szUser32	db	'user32',0
szMessageBox	db	'MessageBoxA',0

.data?
ALoadLibrary	dd	?
AGetProcAddress dd      ?
AMessageBox	dd	?
dwKernel32Base	dd	?

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 代码段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.code
_Handler proc _lpExceptionRecord,_lpSEH,_lpContext,_lpDispatchertext
pushad
mov	esi,_lpExceptionRecord
assume	esi:ptr EXCEPTIONRECORD
mov	edi,_lpContext
assume	edi:ptr CONTEXT
mov	eax,_lpSEH
push	[eax+0ch]
pop	[edi].regEbp
push	[eax+08]
pop	[edi].regEip
push	eax
pop	[edi].regEsp
assume	edi:nothing,esi:nothing
popad
mov	eax,ExceptionContinueExecution
ret
_Handler endp

_GetKernel32Base proc uses edi esi ebx dwEsp
call	@F
@@:
pop	ebx
sub	ebx,offset @B

;安装SEH
assume	fs:nothing
push	ebp
lea	eax, [ebx+offset _safeplace]
push	eax
lea	eax,[ebx + offset _Handler]
push	eax
push	fs:[0]
mov	fs:[0],esp

mov	eax,dwEsp
and	eax,0ffff0000h

.while	eax>=70000000h
.if word ptr [eax] == IMAGE_DOS_SIGNATURE
mov	edi,eax
add	edi,[eax+03ch]
.if word ptr [edi] == IMAGE_NT_SIGNATURE
jmp	find
.endif
.endif
_safeplace:
sub	eax,10000h
.endw
mov	eax,0
find:
pop	fs:[0]
add	esp,0ch
ret
_GetKernel32Base endp

_GetApi	proc	_hModule,_lpszApi
local	@dwReturn,@dwSize
pushad

call	@F
@@:
pop	ebx
sub	ebx,@B

assume	fs:nothing
push	ebp
push	[ebx+offset error]
push	[ebx+offset _Handler]
push	fs:[0]
mov	fs:[0],esp

mov	edi,_lpszApi
mov	ecx,-1
xor	eax,eax
cld
repnz	scasb
sub	edi,_lpszApi
mov	@dwSize,edi

mov	esi,_hModule
add	esi,[esi+3ch]
assume	esi:ptr IMAGE_NT_HEADERS
mov	esi,[esi].OptionalHeader.DataDirectory.VirtualAddress
add	esi,_hModule
assume	esi:ptr IMAGE_EXPORT_DIRECTORY

mov	ebx,[esi].AddressOfNames
add	ebx,_hModule
xor	edx,edx
.while  edx <	[esi].NumberOfNames
push	esi
mov	edi,[ebx]
add	edi,_hModule
mov	esi,_lpszApi
mov	ecx,@dwSize
cld
repz	cmpsb
.if	!ecx
pop	esi
jmp	@F
.endif
next:
pop	esi
inc	edx
add	ebx,4
.endw
jmp	error
@@:
sub	ebx,[esi].AddressOfNames
sub	ebx,_hModule
shr	ebx,1
add	ebx,[esi].AddressOfNameOrdinals
add	ebx,_hModule
movzx	eax,word ptr [ebx]
shl	eax,2
add	eax,[esi].AddressOfFunctions
add	eax,_hModule

mov	eax,[eax]
add	eax,_hModule
mov	@dwReturn,eax
error:
pop	fs:[0]
add	esp,0ch
assume	esi:nothing
popad
mov	eax,@dwReturn
ret
_GetApi endp

start:
mov	eax,[esp]
invoke	_GetKernel32Base,eax
.if	eax
mov	dwKernel32Base,eax
invoke	_GetApi,eax, offset szGetProcAddress
mov	AGetProcAddress,eax
.endif
.if	AGetProcAddress
push	offset szLoadLibrary
push	dwKernel32Base
call	AGetProcAddress
.if	eax
mov	ALoadLibrary,eax
push	offset szUser32
call	eax
.if	eax
push	offset szMessageBox
push	eax
call	AGetProcAddress
.if	eax
mov	AMessageBox,eax
.endif
.endif
.endif
.endif
.if	AMessageBox
push	MB_YESNO
push	offset szCaption
push	offset szText
push	NULL
call	AMessageBox
.endif
ret;invoke	ExitProcess,NULL
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
end	start

.386
.model flat,stdcall
option casemap:none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Include 文件定义
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include		windows.inc

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 代码段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.code

jmp	_NewEntry

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;重要的函数名，为兼容WIN7 kernelbase.dll，增加LoadLibraryA函数
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
szLoadLibraryA db	'LoadLibraryA',0
;szLoadLibraryA   db	'LoadLibraryA',0
szGetProcAddress db	'GetProcAddress',0

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;补丁功能代码需要的DLL，函数名，字符串等全局变量定义
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
szUser32	 db	'user32',0

szMessageBoxA	 db	'MessageBoxA',0

szCaption	db	'恭喜',0
szText		db	'非导入表调用成功!',0

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;SEH错误Handler
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_SEHHandler proc _lpExceptionRecord,_lpSEH,_lpContext,_lpDispatchertext
pushad
mov	esi,_lpExceptionRecord
assume	esi:ptr EXCEPTIONRECORD
mov	edi,_lpContext
assume	edi:ptr CONTEXT
mov	eax,_lpSEH
push	[eax+0ch]
pop	[edi].regEbp
push	[eax+08]
pop	[edi].regEip
push	eax
pop	[edi].regEsp
assume	edi:nothing,esi:nothing
popad
mov	eax,ExceptionContinueExecution
ret
_SEHHandler endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;获取kernel32.dll基地址,2种获取方法自行选择
;PS:用PEB获取最好使用LoadLibraryExA函数以兼容WIN7
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_GetKernel32Base proc uses edi esi ebx _dwEsp
call	@F
@@:
pop	ebx
sub	ebx,offset @B

;安装SEH
assume	fs:nothing
push	ebp
lea	eax, [ebx+offset _safeplace]
push	eax
lea	eax,[ebx + offset _SEHHandler]
push	eax
push	fs:[0]
mov	fs:[0],esp

mov	eax,_dwEsp
and	eax,0ffff0000h

.while	eax>=70000000h
.if word ptr [eax] == IMAGE_DOS_SIGNATURE
mov	edi,eax
add	edi,[eax+03ch]
.if word ptr [edi] == IMAGE_NT_SIGNATURE
jmp	find
.endif
.endif
_safeplace:
sub	eax,10000h
.endw
mov	eax,0
find:
pop	fs:[0]
add	esp,0ch
ret
_GetKernel32Base endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;用PEB获取基址的方法
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;_GetKernel32Base proc
;	local	@dwRet

;	pushad
;
;	assume fs:nothing
;	mov eax,fs:[30h]	;获取PEB所在地址
;	mov eax,[eax+0ch]	;获取PEB_LDR_DATA 结构指针
;	mov esi,[eax+1ch]	;获取InInitializationOrderModuleList 链表头
;				;第一个LDR_MODULE节点InInitializationOrderModuleList成员的指针
;	lodsd			;获取双向链表当前节点后继的指针
;	mov eax,[eax+8]		;获取kernel32.dll的基地址
;	mov @dwRet,eax
;	popad
;
;	mov eax,@dwRet
;	ret
;_GetKernel32Base endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;查找导出表获取制定API地址
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_GetApi	proc	_hModule,_lpszApi
local	@dwReturn,@dwSize
pushad

call	@F
@@:
pop	ebx
sub	ebx,@B

assume	fs:nothing
push	ebp
push	[ebx+offset error]
push	[ebx+offset _SEHHandler]
push	fs:[0]
mov	fs:[0],esp

mov	edi,_lpszApi
mov	ecx,-1
xor	eax,eax
cld
repnz	scasb
sub	edi,_lpszApi
mov	@dwSize,edi

mov	esi,_hModule
add	esi,[esi+3ch]
assume	esi:ptr IMAGE_NT_HEADERS
mov	esi,[esi].OptionalHeader.DataDirectory.VirtualAddress
add	esi,_hModule
assume	esi:ptr IMAGE_EXPORT_DIRECTORY

mov	ebx,[esi].AddressOfNames
add	ebx,_hModule
xor	edx,edx
.while  edx <	[esi].NumberOfNames
push	esi
mov	edi,[ebx]
add	edi,_hModule
mov	esi,_lpszApi
mov	ecx,@dwSize
cld
repz	cmpsb
.if	!ecx
pop	esi
jmp	@F
.endif
next:
pop	esi
inc	edx
add	ebx,4
.endw
jmp	error
@@:
sub	ebx,[esi].AddressOfNames
sub	ebx,_hModule
shr	ebx,1
add	ebx,[esi].AddressOfNameOrdinals
add	ebx,_hModule
movzx	eax,word ptr [ebx]
shl	eax,2
add	eax,[esi].AddressOfFunctions
add	eax,_hModule

mov	eax,[eax]
add	eax,_hModule
mov	@dwReturn,eax
error:
pop	fs:[0]
add	esp,0ch
assume	esi:nothing
popad
mov	eax,@dwReturn
ret
_GetApi endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;补丁功能部分
;_dwKernelBase:		kernel32.dll基址
;_lpGetProcAddress:	GetProcAddress地址
;_lpLoadLibraryA	LoadLibraryA或LoadLibraryA地址
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_Patch	proc	_dwKernelBase,_lpGetProcAddress,_lpLoadLibraryA
local	@hUser32,@lpMessageBoxA

pushad
lea	edx,dword ptr [ebx+offset szUser32]
push	0
push	0
push	edx
call	_lpLoadLibraryA
.if	eax
mov	@hUser32,eax
lea	edx,dword ptr [ebx+offset szMessageBoxA]
push	edx
push	eax
call	_lpGetProcAddress
.if	eax
mov	@lpMessageBoxA,eax
.endif
.endif
.if	@lpMessageBoxA
push	MB_YESNO
lea	edx,dword ptr [ebx+offset szCaption]
push	edx
lea	edx,dword ptr [ebx+offset szText]
push	edx
push	NULL
call	@lpMessageBoxA
.endif
popad
ret
_Patch	endp

_start	proc
local	@dwKernel32Base
local	@lpGetProcAddress,@lpLoadLibraryA

pushad
push	edx
call	_GetKernel32Base
.if	eax
mov	@dwKernel32Base,eax
lea	edx,dword ptr [ebx+offset szGetProcAddress]
push	edx
push	eax
call	_GetApi
mov	@lpGetProcAddress,eax
.endif
.if	@lpGetProcAddress
lea	edx,dword ptr [ebx+offset szLoadLibraryA]
push	edx
push	@dwKernel32Base
call	@lpGetProcAddress
.if	eax
mov	@lpLoadLibraryA,eax
push	eax
push	@lpGetProcAddress
push	@dwKernel32Base
call	_Patch
.endif
.endif

popad
xor	eax,eax
ret
_start	endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;PE文件新入口
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_NewEntry:
mov	edx,[esp]
call	@F
@@:
pop	ebx
sub	ebx,@B
call	_start
;ret
jmpToStart db 0E9h,0F0h,0FFh,0ffh,0ffh	;需要修正
ret
end	_NewEntry

#include <windows.h>
#include <commdlg.h>
#include "resource.h"

#pragma comment(linker,"/BASE:0x70000000")

void PopFileInitialize (HWND hwnd);
BOOL PopFileOpenDlg (HWND hwnd, PTSTR pstrFileName, PTSTR pstrTitleName);

BOOL FixReloc(BYTE *lpImage, DWORD OldImage, PIMAGE_BASE_RELOCATION pRelocData);
BOOL FixIAT(BYTE *lpImage, PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor);
BOOL LoadPE(TCHAR	szFileName[]);
void SetProtect(BYTE *lpImage, PIMAGE_SECTION_HEADER pFirstSection,DWORD dwSectionNum);

//载入PE用到的参数
HINSTANCE	arg1, arg2;
PSTR		arg3;
int			arg4;

int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance,PSTR szCmdLine, int iCmdShow)
{
TCHAR	szFileName[MAX_PATH] ={0};
arg1	= hInstance;
arg2	= hPrevInstance;
arg3	= szCmdLine;
arg4	= iCmdShow;
PopFileInitialize(NULL);
PopFileOpenDlg(NULL, szFileName, TEXT("选择要载入的PE文件") );
if (!LoadPE(szFileName) )
;//MessageBox(NULL, TEXT("载入PE文件失败"), NULL, NULL);
return 0;
}

BOOL LoadPE(TCHAR	szFileName[])
{
//::PIMAGE_DATA_DIRECTORY		pDataDirectory;
::PIMAGE_BASE_RELOCATION	pRelocData;
::PIMAGE_IMPORT_DESCRIPTOR	pImportDescriptor;
::PIMAGE_NT_HEADERS			pNtHeaders;

HANDLE	hFile;
HANDLE	hMap;
BYTE	*lpMemory;
BYTE	*lpImage;

DWORD	dwImageBase;	//文件头基地址
DWORD	dwEntryAddress;	//入口地址
DWORD	dwImageSize;

if (INVALID_HANDLE_VALUE == ( hFile = CreateFile(szFileName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_ARCHIVE, NULL) ) )
{
MessageBox(NULL, L"打开文件失败", NULL, NULL);
return FALSE;
}

hMap	= CreateFileMapping(hFile,  NULL, PAGE_READONLY, 0, 0, NULL);
if (hMap)
{
lpMemory	= (BYTE*)MapViewOfFile (hMap, FILE_MAP_READ, 0, 0, 0);
if (lpMemory)
{

if ( *((WORD*)lpMemory) == 0x5A4D)
{
pNtHeaders	= (PIMAGE_NT_HEADERS)(lpMemory + ((PIMAGE_DOS_HEADER)lpMemory)->e_lfanew);
if (pNtHeaders->Signature == 0x4550)
{
dwImageSize	= pNtHeaders->OptionalHeader.SizeOfImage;
dwImageBase	= pNtHeaders->OptionalHeader.ImageBase;
dwEntryAddress	= pNtHeaders->OptionalHeader.AddressOfEntryPoint;

lpImage		= (PBYTE)VirtualAlloc((LPVOID)dwImageBase, dwImageSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (!lpImage)
{
lpImage	= (PBYTE)VirtualAlloc(NULL, dwImageSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
}

//文件头读入
memset(lpImage, 0, dwImageSize);
memcpy(lpImage, lpMemory, pNtHeaders->OptionalHeader.SizeOfHeaders);

//区段读入
PIMAGE_SECTION_HEADER	pSectionHeader, pFirstSection;
DWORD	dwSectionSize;
DWORD	dwSectionAddr,dwFileAddr;
DWORD	dwSectionNum	= pNtHeaders->FileHeader.NumberOfSections;
pSectionHeader	= pFirstSection = (PIMAGE_SECTION_HEADER)(pNtHeaders+1);

for (DWORD i=0; i < dwSectionNum; i++, pSectionHeader++)
{
dwSectionAddr	= pSectionHeader->VirtualAddress;
dwFileAddr		= pSectionHeader->PointerToRawData;
dwSectionSize	= pSectionHeader->Misc.VirtualSize;
memcpy(lpImage + dwSectionAddr, lpMemory + dwFileAddr, pSectionHeader->SizeOfRawData);
}

//修复IAT
pImportDescriptor	= (PIMAGE_IMPORT_DESCRIPTOR)(lpImage + pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
FixIAT(lpImage, pImportDescriptor);

//重定位修复
if (pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress)
{
pRelocData			= (PIMAGE_BASE_RELOCATION)(lpImage + pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);
FixReloc(lpImage, dwImageBase, pRelocData);
}

SetProtect(lpImage, pFirstSection, dwSectionNum);
//准备跳入PE
DWORD addr = dwEntryAddress + (DWORD)lpImage;
_asm
{
push	arg4
push	arg3
push	arg2
push	lpImage
call	addr
}

}
else
MessageBox(NULL, L"不是PE文件", NULL, NULL);
}
else
MessageBox(NULL, L"不是PE文件", NULL, NULL);
}
}

if (lpMemory)
UnmapViewOfFile (lpMemory);
CloseHandle(hMap);
CloseHandle(hFile);
return FALSE;
}

BOOL FixReloc(BYTE *lpImage, DWORD OldImage, PIMAGE_BASE_RELOCATION pRelocData)
{
DWORD	dwOffset;  //修正用
DWORD	dwBase;		//修正基地址
DWORD	*dwAddress; //需要修正的地址
DWORD	dwNum;	//修正项数
WORD	*wValue;//修正偏移
PIMAGE_BASE_RELOCATION	pReloc;

dwOffset	= (DWORD)(lpImage - OldImage);
pReloc		= pRelocData;
for (; pReloc->VirtualAddress; pReloc++)
{
dwBase	= pReloc->VirtualAddress;
dwNum	= (pReloc->SizeOfBlock - 8) / 2;
wValue	= (WORD*)((DWORD)pReloc + 8);
while(dwNum--)
{
dwAddress	= (DWORD*)(lpImage + dwBase + *wValue);
(*dwAddress)+= dwOffset;
wValue++;
}
}

return TRUE;
}

BOOL FixIAT(BYTE *lpImage, PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor)
{
PIMAGE_IMPORT_DESCRIPTOR	pDllImport;
PIMAGE_THUNK_DATA			pOrignalThunk, pFirstThunk;
PIMAGE_IMPORT_BY_NAME		pImportByName;
HMODULE	hModule;
DWORD	dwAddress,dwFunc;
char	szDllName[MAX_PATH];

for (pDllImport = pImportDescriptor; pDllImport->Name ; pDllImport++)
{
lstrcpyA(szDllName, (char*)(lpImage + pDllImport->Name));
if (!(hModule = GetModuleHandleA(szDllName)) )
hModule	= LoadLibraryA (szDllName);
if (pDllImport->OriginalFirstThunk)
pOrignalThunk	= (PIMAGE_THUNK_DATA)(lpImage + pDllImport->OriginalFirstThunk);
else
pOrignalThunk	= (PIMAGE_THUNK_DATA)(lpImage + pDllImport->FirstThunk);
pFirstThunk	= (PIMAGE_THUNK_DATA)(lpImage + pDllImport->FirstThunk);
for (; pOrignalThunk->u1.Function; pOrignalThunk++, pFirstThunk++)
{
if ( (pOrignalThunk->u1.Ordinal) & 0x80000000) //序号导入
{
dwFunc	= pOrignalThunk->u1.Ordinal;
dwFunc	&= 0x7fffffff;
}
else    //名称导入
{
pImportByName	= (PIMAGE_IMPORT_BY_NAME)(lpImage + pOrignalThunk->u1.Function);
dwFunc	= (DWORD)pImportByName->Name;
}
dwAddress	= (DWORD)GetProcAddress (hModule, (LPCSTR)dwFunc);
pFirstThunk->u1.Function	= dwAddress;
}
}

return TRUE;
}

void SetProtect(BYTE *lpImage, PIMAGE_SECTION_HEADER pFirstSection,DWORD dwSectionNum)
{
PIMAGE_SECTION_HEADER	pSectionHeader = pFirstSection;
DWORD	dwProtect;
DWORD	dwSectionSize, dwSectionAddr;
for (DWORD i=0; i < dwSectionNum; i++, pSectionHeader++)
{
dwSectionSize	= pSectionHeader->Misc.VirtualSize;
dwSectionAddr	= pSectionHeader->VirtualAddress;
if (pSectionHeader->Characteristics & IMAGE_SCN_MEM_READ)
dwProtect	= PAGE_READONLY;
if (pSectionHeader->Characteristics & IMAGE_SCN_MEM_WRITE)
dwProtect	= PAGE_READWRITE;
if (pSectionHeader->Characteristics & IMAGE_SCN_MEM_EXECUTE)
{
if (pSectionHeader->Characteristics & IMAGE_SCN_MEM_READ)
dwProtect	= PAGE_EXECUTE_READ;
else if (pSectionHeader->Characteristics & IMAGE_SCN_MEM_WRITE)
dwProtect	= PAGE_EXECUTE_READWRITE;
else
dwProtect	= PAGE_EXECUTE;
}
DWORD	OldProtect;
if (!VirtualProtect(lpImage+dwSectionAddr, dwSectionSize, dwProtect, &OldProtect) )
MessageBox(NULL,L"页面属性设置失败", NULL, 0);

}
}

///////////////////////////////////打开文件对话框/////////////////////////////////////////////////////////
static OPENFILENAME ofn ;

void PopFileInitialize (HWND hwnd)
{
static TCHAR szFilter[] = TEXT ("PE Files \0*.exe;*.dll\0")  \
TEXT ("All Files (*.*)\0*.*\0\0") ;

ofn.lStructSize       = sizeof (OPENFILENAME) ;
ofn.hwndOwner         = hwnd ;
ofn.hInstance         = NULL ;
ofn.lpstrFilter       = szFilter ;
ofn.lpstrCustomFilter = NULL ;
ofn.nMaxCustFilter    = 0 ;
ofn.nFilterIndex      = 0 ;
ofn.lpstrFile         = NULL ;          // Set in Open and Close functions
ofn.nMaxFile          = MAX_PATH ;
ofn.lpstrFileTitle    = NULL ;          // Set in Open and Close functions
ofn.nMaxFileTitle     = MAX_PATH ;
ofn.lpstrInitialDir   = NULL ;
ofn.lpstrTitle        = NULL ;
ofn.Flags             = 0 ;             // Set in Open and Close functions
ofn.nFileOffset       = 0 ;
ofn.nFileExtension    = 0 ;
ofn.lpstrDefExt       = TEXT ("txt") ;
ofn.lCustData         = 0L ;
ofn.lpfnHook          = NULL ;
ofn.lpTemplateName    = NULL ;
}

BOOL PopFileOpenDlg (HWND hwnd, PTSTR pstrFileName, PTSTR pstrTitleName)
{
ofn.hwndOwner         = hwnd ;
ofn.lpstrFile         = pstrFileName ;
ofn.lpstrTitle		   = pstrTitleName ;
ofn.Flags             = OFN_HIDEREADONLY | OFN_CREATEPROMPT ;

return GetOpenFileName (&ofn) ;
}

///////////////////////////////////////////////////////////////////////////////////////////////////////////////////