滴水逆向_新增节

news/2025/3/15 21:45:46/

1 本人亲测过了，在win10，win11 下也是可以新增的

2 手动就不演示了， 能够准确地写程序完成新增节并且正常运行。

3 无论是内存对齐，文件对齐 相等还是说不相等都是可以实现的，测试过了。

附上代码：

header.h

#pragma once
#define _CRT_SECURE_NO_WARNINGS 
#include<stdio.h>
#include<stdlib.h>
#include<string.h>
#include<stddef.h>
#include<Windows.h>#define FILEPATH_IN "D:\\pelianxi\\$RDIZSRI.exe"       //自己改路径#define FILEPATH_OUT "D:\\pelianxi\\飞鸽传书新增节.exe"    //自己改路径#define ADDRBUFFER  0X1000             //扩充内存大小int READPEFILE_(char* filepath, char** pfilebuffer);//硬盘中新增一个节
int ADDRNEWSECTION_(char* pfilebuffer, char** poutfilebuffer);int FILEBUFFERTOIMAGBBUFFER_(char* pfilebuffer, char** imagebuffer);int IMAGEBUFFERTONEWBUFFER_(char* imagebuffer, char** newbuffer);int WRITEPEFILE_(char* pfilepath, char* pfilebuffer, int filesize);int FREEBUFFER_(char* pfilebuffer);

#include"header.h"int READPEFILE_(char* filepath, char** pfilebuffer)
{FILE* PFILE = NULL;PFILE = fopen(filepath, "rb");if (!PFILE){printf("读取失败\n");return 0;}fseek(PFILE, 0, SEEK_END);int FILESIZE = ftell(PFILE);fseek(PFILE, 0, SEEK_SET);char* PFILETEMPBUFFER = (char*)malloc(sizeof(char) * FILESIZE);if (!PFILETEMPBUFFER){printf("读取失败\n");free(PFILETEMPBUFFER);PFILETEMPBUFFER = NULL;fclose(PFILE);return 0;}memset(PFILETEMPBUFFER, 0, sizeof(char) * FILESIZE);size_t n = fread(PFILETEMPBUFFER, FILESIZE, 1, PFILE);if (!n){printf("失败");free(PFILETEMPBUFFER);PFILETEMPBUFFER = NULL;fclose(PFILE);return 0;}*pfilebuffer = PFILETEMPBUFFER;PFILETEMPBUFFER = NULL;fclose(PFILE);return FILESIZE;
}int ADDRNEWSECTION_(char* pfilebuffer, char** poutfilebuffer)
{if (!pfilebuffer){MessageBox(0, TEXT("缓冲区不存在"), 0, 0);return 0;}if (*(short*)(pfilebuffer) != 0X5A4D){MessageBox(0, TEXT("不是一个mz文件标志"), 0, 0);return 0;}PIMAGE_DOS_HEADER PDOSHEADER = (PIMAGE_DOS_HEADER)pfilebuffer;if (*(PDWORD)((char*)pfilebuffer + PDOSHEADER->e_lfanew) != IMAGE_NT_SIGNATURE){MessageBox(0, TEXT("不是一个NT标记"), 0, 0);return 0;}PIMAGE_NT_HEADERS PNTHEADER = (PIMAGE_NT_HEADERS)((char*)pfilebuffer + PDOSHEADER->e_lfanew);PIMAGE_FILE_HEADER PFILEHEADER = (PIMAGE_FILE_HEADER)(((char*)PNTHEADER) + 0X4);PIMAGE_OPTIONAL_HEADER POPTIONHEADER = (PIMAGE_OPTIONAL_HEADER)(((char*)PFILEHEADER) + 0x14);PIMAGE_SECTION_HEADER PSECTIONHEADER = (PIMAGE_SECTION_HEADER)((char*)POPTIONHEADER + PFILEHEADER->SizeOfOptionalHeader);//判断空间够不够int num = 0x28 * PFILEHEADER->NumberOfSections; if (POPTIONHEADER->SizeOfHeaders - PDOSHEADER->e_lfanew - 0x18 - PFILEHEADER->SizeOfOptionalHeader - num < 2 * 0x28){printf("没有多的空间新增节\n");return 0;}PFILEHEADER->NumberOfSections += 1;POPTIONHEADER->SizeOfImage += ADDRBUFFER;char name[8] = { 'N','e','c','_','S','e','c','\0' };int pnewsec = ((char*)PSECTIONHEADER) + (0X28 * (PFILEHEADER->NumberOfSections - 1));memcpy((char*)pnewsec, &name, 0x8);PIMAGE_SECTION_HEADER pnewsection = (PIMAGE_SECTION_HEADER)pnewsec;pnewsection->SizeOfRawData = ADDRBUFFER;pnewsection->Misc.VirtualSize = ADDRBUFFER;//找到前面这个节，后面一个节需前面一个节 的文件开始的地方 加上  文件对齐以后的数据 pnewsection->PointerToRawData = PSECTIONHEADER[PFILEHEADER->NumberOfSections - 1 - 1].PointerToRawData+ PSECTIONHEADER[PFILEHEADER->NumberOfSections - 1 - 1].SizeOfRawData;pnewsection->VirtualAddress = POPTIONHEADER->SizeOfImage - ADDRBUFFER;//修改可执行属性pnewsection->Characteristics = 0x60000020;//计算硬盘中大小int sizeoffile = PSECTIONHEADER[PFILEHEADER->NumberOfSections - 1 - 1].PointerToRawData + PSECTIONHEADER[PFILEHEADER->NumberOfSections - 1 - 1].SizeOfRawData;char* newbuffer = malloc(sizeof(char) * (sizeoffile + ADDRBUFFER));if (!newbuffer){printf("申请内存失败\n");return 0;}memset((void*)newbuffer, 0, sizeoffile + ADDRBUFFER);memcpy((void*)newbuffer, PDOSHEADER, sizeoffile);*poutfilebuffer = newbuffer;newbuffer = NULL;return sizeoffile;
}int FILEBUFFERTOIMAGBBUFFER_(char* pfilebuffer, char** imagebuffer)
{if (!pfilebuffer){MessageBox(0, TEXT("缓冲区不存在"), 0, 0);return 0;}if (*(short*)(pfilebuffer) != 0X5A4D){MessageBox(0, TEXT("不是一个mz文件标志"), 0, 0);return 0;}PIMAGE_DOS_HEADER PDOSHEADER = (PIMAGE_DOS_HEADER)pfilebuffer;if (*(PDWORD)((char*)pfilebuffer + PDOSHEADER->e_lfanew) != IMAGE_NT_SIGNATURE){MessageBox(0, TEXT("不是一个NT标记"), 0, 0);return 0;}PIMAGE_NT_HEADERS PNTHEADER = (PIMAGE_NT_HEADERS)((char*)pfilebuffer + PDOSHEADER->e_lfanew);PIMAGE_FILE_HEADER PFILEHEADER = (PIMAGE_FILE_HEADER)(((char*)PNTHEADER) + 0X4);PIMAGE_OPTIONAL_HEADER POPTIONHEADER = (PIMAGE_OPTIONAL_HEADER)((char*)PFILEHEADER + 0x14);PIMAGE_SECTION_HEADER PSECTIONHEADER = (PIMAGE_SECTION_HEADER)((char*)POPTIONHEADER + PFILEHEADER->SizeOfOptionalHeader);//固定动态基址PFILEHEADER->Characteristics |= IMAGE_FILE_RELOCS_STRIPPED;char* PIMAGETEMPBUFFER = malloc(sizeof(char) * POPTIONHEADER->SizeOfImage);if (!PIMAGETEMPBUFFER){return 0;}memset(PIMAGETEMPBUFFER, 0, sizeof(char) * POPTIONHEADER->SizeOfImage);memcpy((void*)PIMAGETEMPBUFFER, PDOSHEADER, POPTIONHEADER->SizeOfHeaders);PIMAGE_SECTION_HEADER PTEMPSECTION = (PIMAGE_SECTION_HEADER)PSECTIONHEADER;for (int i = 0; i < PFILEHEADER->NumberOfSections; i++){memcpy((void*)((char*)PIMAGETEMPBUFFER + PTEMPSECTION[i].VirtualAddress),(void*)((char*)PDOSHEADER + PTEMPSECTION[i].PointerToRawData),PTEMPSECTION[i].SizeOfRawData);}*imagebuffer = PIMAGETEMPBUFFER;PIMAGETEMPBUFFER = NULL;return POPTIONHEADER->SizeOfImage;
}int IMAGEBUFFERTONEWBUFFER_(char* pimagebuffer, char** newbuffer)
{if (!pimagebuffer){MessageBox(0, TEXT("缓冲区不存在"), 0, 0);return 0;}if (*(short*)(pimagebuffer) != 0X5A4D){MessageBox(0, TEXT("不是一个mz文件标志"), 0, 0);return 0;}PIMAGE_DOS_HEADER PDOSHEADER = (PIMAGE_DOS_HEADER)pimagebuffer;if (*(PDWORD)((char*)pimagebuffer + PDOSHEADER->e_lfanew) != IMAGE_NT_SIGNATURE){MessageBox(0, TEXT("不是一个NT标记"), 0, 0);return 0;}PIMAGE_NT_HEADERS PNTHEADER = (PIMAGE_NT_HEADERS)((char*)pimagebuffer + PDOSHEADER->e_lfanew);PIMAGE_FILE_HEADER PFILEHEADER = (PIMAGE_FILE_HEADER)(((char*)PNTHEADER) + 0X4);PIMAGE_OPTIONAL_HEADER POPTIONHEADER = (PIMAGE_OPTIONAL_HEADER)((char*)PFILEHEADER + 0x14);PIMAGE_SECTION_HEADER PSECTIONHEADER = (PIMAGE_SECTION_HEADER)((char*)POPTIONHEADER + PFILEHEADER->SizeOfOptionalHeader);char* PTEMPNEWBUFFER = malloc(sizeof(char) * POPTIONHEADER->SizeOfImage);if (!PTEMPNEWBUFFER){return 0;}memset(PTEMPNEWBUFFER, 0, sizeof(char) * POPTIONHEADER->SizeOfImage);memcpy((void*)PTEMPNEWBUFFER, PDOSHEADER, POPTIONHEADER->SizeOfHeaders);PIMAGE_SECTION_HEADER PTEMPSECTION = (PIMAGE_SECTION_HEADER)PSECTIONHEADER;for (int i = 0; i < PFILEHEADER->NumberOfSections; i++){memcpy((void*)((char*)PTEMPNEWBUFFER + PTEMPSECTION[i].PointerToRawData),(void*)((char*)pimagebuffer + PTEMPSECTION[i].VirtualAddress),PTEMPSECTION[i].SizeOfRawData);}*newbuffer = PTEMPNEWBUFFER;PTEMPNEWBUFFER = NULL;return POPTIONHEADER->SizeOfImage;
}int WRITEPEFILE_(char* pfilepath, char* pfilebuffer, int filesize)
{FILE* PFILE = NULL;PFILE = fopen(pfilepath, "wb");if (!PFILE){return 0;}size_t n = fwrite(pfilebuffer, filesize, 1, PFILE);if (!n){fclose(PFILE);return 0;}fclose(PFILE);return 1;
}int FREEBUFFER_(char* pfilebuffer)
{if (!pfilebuffer){return 0;}else{free(pfilebuffer);pfilebuffer = NULL;}}

#include"header.h"char* pfilebuffer = NULL;char* pimagebuffer = NULL;char* paddrfilebuffer = NULL;char* newbuffer = NULL;int main()
{READPEFILE_(FILEPATH_IN, &pfilebuffer);ADDRNEWSECTION_(pfilebuffer, &paddrfilebuffer);FILEBUFFERTOIMAGBBUFFER_(paddrfilebuffer, &pimagebuffer);int filesize = IMAGEBUFFERTONEWBUFFER_(pimagebuffer, &newbuffer);WRITEPEFILE_(FILEPATH_OUT, newbuffer, filesize);system("pause");return 0;
}


http://www.ppmy.cn/news/1573099.html

相关文章

Python 高级特性

Python 高级特性

1. 装饰器（Decorators） 用途：动态修改函数/类的行为，常用于日志、权限、缓存等场景。示例：def timer(func):def wrapper(*args, **kwargs):start = time.time()result = func(*args, **kwargs)end = time.time()print(f"{func.__name__} executed in {end - start:.2…
阅读更多...
括 号 问题

括 号 问题

E-lz的括号问题_牛客小白月赛105 #include <bits/stdc.h> #define int long long using namespace std; string s; vector<vector<int>>f(1000000); signed main() {ios::sync_with_stdio(0);cin.tie(0),cout.tie(0);int n;cin>>n;cin>>s;queue…
阅读更多...
Windows环境安装部署minimind步骤

Windows环境安装部署minimind步骤

Windows环境安装部署minimind步骤 必要的软件环境 git git&#xff0c;可下载安装版&#xff0c;本机中下载绿色版&#xff0c;解压到本地目录下&#xff08;如&#xff1a;c:\soft\git.win64&#xff09;&#xff0c;可将此路径添加到PATH环境变量中&#xff0c;供其他程序…
阅读更多...
【线段树 二分查找】P3939 数颜色|普及+

【线段树 二分查找】P3939 数颜色|普及+

本文涉及知识点 C线段树 C二分查找 P3939 数颜色 题目背景 大样例可在页面底部「附件」中下载。 题目描述 小 C 的兔子不是雪白的&#xff0c;而是五彩缤纷的。每只兔子都有一种颜色&#xff0c;不同的兔子可能有 相同的颜色。小 C 把她标号从 1 到 n n n 的 n n n 只兔…
阅读更多...
利用Ollama搭建本地DeepSeek大模型

利用Ollama搭建本地DeepSeek大模型

1. 下载安装ollama (1) 官网下载地址&#xff1a;https://github.com/ollama/ollama 这里以window版本为主&#xff0c;下载链接为&#xff1a;https://ollama.com/download/OllamaSetup.exe。 安装完毕后&#xff0c;桌面小图标有一个小图标&#xff0c;表示已安装成功&…
阅读更多...
响应式布局学习笔记

响应式布局学习笔记

什么是响应式布局&#xff1f; 响应式布局&#xff08;Responsive Web Design&#xff09;是一种网页设计方法&#xff0c;使网站能够根据设备屏幕尺寸&#xff08;如手机、平板、电脑&#xff09;自动调整内容和布局&#xff0c;提供最佳浏览体验。 如何调试响应式布局&…
阅读更多...
JavaEE基础 Tomcat与Http （下）

JavaEE基础 Tomcat与Http （下）

目录 1.HTTP 协议 1.1 HTTP 协议概念 1.2. 无状态协议 1.3. HTTP1.0 和 HTTP1.1 1.4 请求协议和响应协议 ​编辑 1.5 请求协议 1.5.1 常见的请求协议 1.5.2 GET 请求 1.5.3 POST请求 1.5.4 响应协议 1.HTTP 协议 Http浏览器访问东西都是遵循的Http协议。 1.1 HTTP 协议…
阅读更多...
关于Node.js前端面试的试题概念、工作原理及实际应用

关于Node.js前端面试的试题概念、工作原理及实际应用

文章目录 1. 什么是Node.js&#xff1f;2. Node.js是如何工作的&#xff1f;3. Node.js与其他流行的框架相比有何优势&#xff1f;4. Node.js如何克服I/O操作阻塞的问题&#xff1f;5. 为什么Node.js是单线程的&#xff1f;6. 如果Node.js是单线程的&#xff0c;那么它是如何处…
阅读更多...
最新文章

Copyright @ 2022~2023