自己写的PEtools

2262343003

                                                                                                                                                功能
每一个功能自己都测试过，自己测试的时候没有问题，包括文件对齐和内存对齐不一样时。
自己需要就拿走把，下面直接是源码

对了，是用c语言写的

//判断文件是否为PE文件

//文件与内存连接

//rva转换foa

//foa转rva

//得到导出表

//打印导出表

//打印导出表的函数名称

//得到pe头

//由名字或者序号函数函数地址

//打印重定位表

//给PE文件新增节

//pe文件由filebuffer手动转iamgebuffer

//pe文件由iamgebuffer手动转filebuffer

//存盘

//加入meassageboxa(简单的加入shellcode)

//打印PE

//移动导出表

//移动重定位表

//修改PE的imagebase,同时修复重定位表

//得到导入表

//打印导入表

//得到绑定导入表

//打印绑定导入表

//移动导入表加注入自己的导入表


                                                                                                                                                   源码
#include <stdio.h>
#include <malloc.h>
#include <stdlib.h>
#include <windows.h>
#include <string.h>

//判断buffer是否为PE文件
BOOL judgePE(char* buffer);

//file与buffer连接
char* FILEtoBUFFER(FILE* hfile);//返回连接后的地址

//rva转换foa
unsigned long RVAtoFOA(char* buffer, unsigned long hRVA);//返回foa

//foa转rva
unsigned long FOAtoRVA(char* buffer, unsigned long hFOA);//返回RVA

//得到输出表
PIMAGE_EXPORT_DIRECTORY Get_Export_directory(char* buffer);

//打印输出表
void print_export(char* buffer);

//打印输出表的函数名称
void print_function_name(char* buffer);

//得到pe头
PIMAGE_NT_HEADERS GET_nt_header(char* buffer);

//得到函数地址
void* GetFunctionAddrByName(char* buffer, const char* Function_Name);
void* GetFunctionAddrByOrdinals(char* buffer, short Ordinal);

//打印重定位表
void print_base_relocation(char* buffer);

//新增节
char* increase_section(char* imagebuffer, DWORD size);   //返回增加后节的地址

//拉伸
char* filebuffertoimagebuffer(char* buffer, int judge, DWORD size);

//还原
char* iamgebuffertonewbuffer(char* imagebuffer, int judge, DWORD size);

//存盘
void savebuffer(char* buffer, int judge, DWORD size);

//加入meassageboxa
char* shellcodetoimagebuffer(char* imagebuffer);

//打印PE
void print_PE();

//移动导出表
void move_export_directory(char* filebuffer);

//移动重定位表
void move_base_relocation(char* filebuffer);

//修改PE的imagebase,同时修复重定位表
char* modify_imagebase(char* filebuffer, DWORD newimagebase);

//得到导入表
PIMAGE_IMPORT_DESCRIPTOR Get_Import_descrtiptor(char* buffer);

//打印导入表
void print_import_descriptor(char* buffer);

//得到绑定导入表
PIMAGE_BOUND_IMPORT_DESCRIPTOR Get_Bound_import_descriptor(char* buffer);

//打印绑定导入表
void print_bound_import_descriptor(char* buffer);

//移动导入表加注入导入表
void move_import_descriptor(char* filebuffer);



#define FILENAME_ONE "C:\\Users\\Admin\\Desktop\\111.exe"     //内存对齐0x1000  文件对齐0x200
//#define FILENAME_TWO "D:\\学习\逆向破解合集\\新建文件夹\\其他精品逆向\\01NCK-逆向破解初级班__线上班\\破解工具\\OllyDbg.exe"   //有输出表  内存对齐0x1000  文件对齐0x200
#define FILENAME_THREE "C:\\Users\\Admin\\Desktop\\4.1.exe"        //内存对齐0x1000  文件对齐0x1000
#define FILENAME_ERROR "C:\\Users\\Admin\\Desktop\\笔记.txt"     //查看是否能判断
#define BUFFERNAME "C:\\Users\\Admin\\Desktop\\222.exe"     //打开方式为wb+

#define SHELLCODE 18
#define SIZE_SECTION 0x10000

char shellcode[] = {
                    0X6A,0X00,0X6A,0X00,0X6A,0X00,0X6A,0X00,
                    0XE8,0X00,0X00,0X00,0X00,
                    0XE9,0X00,0X00,0X00,0X00
};


#pragma warning(disable:4996)


void main()
{
    FILE* hfile = fopen(FILENAME_ONE, "rb+");
    if (NULL == hfile)
    {
        printf("请输入正确的地址\n");
        return;
    }
    char* filebuffer = FILEtoBUFFER(hfile);
    if (NULL == filebuffer)
    {
        fclose(hfile);
        return;
    }
    if (FALSE == judgePE(filebuffer))
    {
        free(filebuffer);
        fclose(hfile);
        return;
    }


    char* imagebuffer = filebuffertoimagebuffer(filebuffer, 1, SIZE_SECTION);//拉伸
    increase_section(imagebuffer, SIZE_SECTION);//增节
    filebuffer = iamgebuffertonewbuffer(imagebuffer, 1, SIZE_SECTION);//还原
    //jiami_PE(filebuffer,hfile, SIZE_SECTION);//加密    节区的内容都加1
    jiemi_PE(filebuffer, hfile,SIZE_SECTION);//解密    节区的内容都减1
    savebuffer(filebuffer, 1, SIZE_SECTION);//存盘


    free(imagebuffer);
    free(filebuffer);
    fclose(hfile);
    return;
}





BOOL judgePE(char* buffer)
{
    if (IMAGE_DOS_SIGNATURE != *((short*)buffer))
    {
        printf("该文件不是PE文件           judgePE\n");
        return FALSE;
    }
    //dos
    PIMAGE_DOS_HEADER f_dos_header = (PIMAGE_DOS_HEADER)buffer;
    //pe
    PIMAGE_NT_HEADERS f_nt_header = (PIMAGE_NT_HEADERS)((unsigned long)buffer + (unsigned long)f_dos_header->e_lfanew);
    if (IMAGE_NT_SIGNATURE != f_nt_header->Signature)
    {
        printf("该文件不是PE文件\n");
        return FALSE;
    }
    return TRUE;
}

unsigned long RVAtoFOA(char* buffer ,unsigned long hRVA)
{
    unsigned long hfov = 0;
    PIMAGE_NT_HEADERS f_nt_header = GET_nt_header(buffer);
    //section;
    PIMAGE_SECTION_HEADER f_section_header = (PIMAGE_SECTION_HEADER)((unsigned long)f_nt_header + (unsigned long)24 + (unsigned long)f_nt_header->FileHeader.SizeOfOptionalHeader);
    //numberofsection
    int numer_section = f_nt_header->FileHeader.NumberOfSections;
    //计算foa
    while (numer_section--)
    {

        if (hRVA < f_section_header->VirtualAddress)
        {
            hfov = hRVA;
            break;
        }
        if (hRVA >= f_section_header->VirtualAddress && hRVA < f_section_header->VirtualAddress + f_section_header->Misc.VirtualSize)
        {
            hfov = hRVA - f_section_header->VirtualAddress + f_section_header->PointerToRawData;
            break;
        }

        f_section_header++;
    }
    if (hfov != 0)
    {
        return hfov;
    }
    else
    {
        printf("RVA错误              RVAtoFOA\n");
        return hfov;
    }
}

unsigned long FOAtoRVA(char* buffer, unsigned long hFOA)
{
    unsigned long hRVA = 0;
    PIMAGE_NT_HEADERS f_nt_header = GET_nt_header(buffer);
    //section;
    PIMAGE_SECTION_HEADER f_section_header = (PIMAGE_SECTION_HEADER)((unsigned long)f_nt_header + (unsigned long)24 + (unsigned long)f_nt_header->FileHeader.SizeOfOptionalHeader);
    //numberofsection
    int numer_section = f_nt_header->FileHeader.NumberOfSections;
    //计算rva
    while (numer_section--)
    {
        if (hFOA < f_section_header->PointerToRawData)
        {
            hRVA = hFOA;
            break;
        }
        if (hFOA >= f_section_header->PointerToRawData && hFOA < f_section_header->PointerToRawData + f_section_header->SizeOfRawData)
        {
            hRVA = hFOA - f_section_header->PointerToRawData + f_section_header->VirtualAddress;
            break;
        }

        f_section_header++;
    }
    if (hRVA != 0)
    {
        return hRVA;
    }
    else
    {
        printf("RVA错误              FOAtoRVA\n");
        return hRVA;
    }
}

char* FILEtoBUFFER(FILE* hfile)
{
    //计算hfile的大小
    fseek(hfile, 0, SEEK_END);
    long hsize = ftell(hfile);
    fseek(hfile, 0, SEEK_SET);
    //申请
    char* buffer = (char*)malloc(hsize);
    if (NULL == buffer)
    {
        printf("申请内存错误      FILEtoBUFFER \n");
        return NULL;
    }
    //写内存
    fread(buffer, hsize, 1, hfile);
    return buffer;
}

PIMAGE_NT_HEADERS GET_nt_header(char* buffer)
{
    //dos
    PIMAGE_DOS_HEADER f_dos_header = (PIMAGE_DOS_HEADER)buffer;
    //pe
    PIMAGE_NT_HEADERS f_nt_header = (PIMAGE_NT_HEADERS)((unsigned long)buffer + (unsigned long)f_dos_header->e_lfanew);
    return f_nt_header;

}

void print_export(char* buffer)
{
    //得到输出表
    PIMAGE_EXPORT_DIRECTORY f_export_directory = Get_Export_directory(buffer);
    if (0 == f_export_directory)
    {
        printf("错误              Get_Export_directory\n");
        return;
    }
    printf("文件名        %s\n", buffer+ RVAtoFOA(buffer,f_export_directory->Name));
    printf("起始序号地址  %x\n", f_export_directory->Base);
    printf("函数总数      %x\n", f_export_directory->NumberOfFunctions);
    printf("有名字个数    %x\n", f_export_directory->NumberOfNames);
    printf("导出函数地址表地址    %x\n", (unsigned long)buffer + (unsigned long)RVAtoFOA(buffer, f_export_directory->AddressOfFunctions));
    printf("导出函数名称表地址    %x\n", (unsigned long)buffer + (unsigned long)RVAtoFOA(buffer, f_export_directory->AddressOfNames));
    printf("导出函数序号表地址    %x\n", (unsigned long)buffer+(unsigned long)RVAtoFOA(buffer, f_export_directory->AddressOfNameOrdinals));
     

    return;
}

PIMAGE_EXPORT_DIRECTORY Get_Export_directory(char* buffer)
{
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(buffer);
    //得到输出表地址
    unsigned long export_add = f_nt_headers->OptionalHeader.DataDirectory[0].VirtualAddress;
    unsigned long export_add_foa = RVAtoFOA(buffer, export_add);
    //得到输出表
    PIMAGE_EXPORT_DIRECTORY f_export_directory = (PIMAGE_EXPORT_DIRECTORY)((unsigned long)buffer + (unsigned long)export_add_foa);
    return f_export_directory;
}

void print_function_name(char* buffer)
{
    //得到输出表
    PIMAGE_EXPORT_DIRECTORY f_export_directory = Get_Export_directory(buffer);
    if (0 == f_export_directory)
    {
        printf("可能是改文件没有输出表              print_function_name\n");
        return;
    }
    //得到有名字函数的数量
    short number_namefunctions = f_export_directory->NumberOfNames;
    printf("有名字函数的数量为%d\n\n", number_namefunctions);
    //得到函数名称表    注意转换成foa
    int* namefunction_table = (int*)(buffer + RVAtoFOA(buffer, f_export_directory->AddressOfNames));
    //得到表里面的地址并打印      注意函数名称地址转换成foa
    int i = 1;
    while (number_namefunctions--)
    {
        DWORD function_add_rva = *(namefunction_table++);
        DWORD function_add_foa = RVAtoFOA(buffer, function_add_rva);
        printf("第%d个函数名称：%s\n", i++,buffer + function_add_foa);
    }
}

void* GetFunctionAddrByName(char* buffer, const char* Function_Name)
{
    PIMAGE_EXPORT_DIRECTORY f_export_directory = Get_Export_directory(buffer);
    int* namefunction_table = (int*)(buffer + RVAtoFOA(buffer, f_export_directory->AddressOfNames));
    int i = f_export_directory->NumberOfNames;
    short jishu = 0;
    while (i--)
    {
        DWORD function_add_rva = *(namefunction_table++);
        DWORD function_add_foa = RVAtoFOA(buffer, function_add_rva);;
        if (0 == strcmp(buffer+ function_add_foa, Function_Name))
        {
            //得到序号表
            char* ordial_table = (buffer + RVAtoFOA(buffer, f_export_directory->AddressOfNameOrdinals));
            //得到序号
            ordial_table = ordial_table + jishu * 2;
            short ordinal_foa = *(short*)ordial_table;
            //得到函数表
            char* function_table = buffer + RVAtoFOA(buffer, f_export_directory->AddressOfFunctions);
            //取地址表里面的值
            char* p_function_add = function_table + ordinal_foa * 4;
            unsigned long function_foa = *((int*)p_function_add);

             return (void*)function_foa;
        }
        jishu++;
    }

    return 0;
}

void* GetFunctionAddrByOrdinals(char* buffer, short Ordinal)
{
    PIMAGE_EXPORT_DIRECTORY f_export_directory = Get_Export_directory(buffer);
    //得到base
    short base = f_export_directory->Base;
    //printf("%s的序号是%d", Function_Name, ordinal_foa);
    //得到函数表
    char* function_table = buffer + RVAtoFOA(buffer, f_export_directory->AddressOfFunctions);
    //取地址表里面的值
    function_table = function_table + (Ordinal- base) * 4;
    unsigned long function_foa = *((int*)function_table);

    return (void*)function_foa;
}

void print_base_relocation(char* buffer)
{
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(buffer);
    //得到重定位表地址
    char* f_base_relocation_add = buffer + RVAtoFOA(buffer,f_nt_headers->OptionalHeader.DataDirectory[5].VirtualAddress);

    PIMAGE_BASE_RELOCATION f_base_relocation = (PIMAGE_BASE_RELOCATION)f_base_relocation_add;
    int i = 1;
    while (0 != f_base_relocation->SizeOfBlock && 0 != f_base_relocation->VirtualAddress)
    {
        printf("分割线***********************\n\n");
        printf("第%d分块的初始地址%x\n",i++, f_base_relocation->VirtualAddress);
        unsigned long number_of_add = (f_base_relocation->SizeOfBlock - 8) / 2;
        //得到地址
        short* a = (short*)f_base_relocation + 4;
        while (number_of_add--)
        {
            short b = *(a);
            if (3 == b >> 12)
            {
                b = b & 4095;
                printf("地址是%x   属性是3\n", b + f_base_relocation->VirtualAddress);
                printf("                %x\n", *(int*)(buffer + RVAtoFOA(buffer, b + f_base_relocation->VirtualAddress)));
            }
            else if(b != 0x3000)
            {
                printf("地址是%x   属性是0\n", b + f_base_relocation->VirtualAddress);
            }
            a++;
        }
        f_base_relocation = (PIMAGE_BASE_RELOCATION)((unsigned long)f_base_relocation + f_base_relocation->SizeOfBlock);
    }
}

char* filebuffertoimagebuffer(char* filebuffer,int judge,DWORD size)
{
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(filebuffer);
    //得到节表
    PIMAGE_SECTION_HEADER f_section_header = (PIMAGE_SECTION_HEADER)((DWORD)f_nt_headers + 24 + (DWORD)f_nt_headers->FileHeader.SizeOfOptionalHeader);
    //得到imagebuffer的大小
    DWORD size_iamgebuffer = f_nt_headers->OptionalHeader.SizeOfImage;
    //申请imagebuffer
    char* imagebuffer = NULL;
    if (0 != judge)
    {
        imagebuffer = (char*)malloc(size_iamgebuffer+ size);
        if (NULL == imagebuffer)
        {
            printf("申请iamgebuffer错误\n");
            return 0;
        }
        //初始化iamgebuffer
        memset(imagebuffer, 0, size_iamgebuffer+ size);
    }

    else
    {
        imagebuffer = (char*)malloc(size_iamgebuffer);
        if (NULL == imagebuffer)
        {
            printf("申请iamgebuffer错误\n");
            return 0;
        }
        //初始化iamgebuffer
        memset(imagebuffer, 0, size_iamgebuffer);
    }
    //开始拉伸
    //1 copy头和节表
    memcpy(imagebuffer, filebuffer, f_nt_headers->OptionalHeader.SizeOfHeaders);
    //2 copy节
    DWORD number_section = f_nt_headers->FileHeader.NumberOfSections;
    while (number_section--)
    {
        memcpy(imagebuffer + f_section_header->VirtualAddress, filebuffer + f_section_header->PointerToRawData, f_section_header->SizeOfRawData);
        f_section_header++;
    }
    return imagebuffer;
}

char* iamgebuffertonewbuffer(char* imagebuffer,int judge, DWORD size)
{
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(imagebuffer);
    //得到节表
    PIMAGE_SECTION_HEADER f_section_header = (PIMAGE_SECTION_HEADER)((DWORD)f_nt_headers + 24 + (DWORD)f_nt_headers->FileHeader.SizeOfOptionalHeader);
    //计算hfile的大小
    FILE* hfile = fopen(FILENAME_ONE, "rb+");
    fseek(hfile, 0, SEEK_END);
    DWORD size_filebuffer = ftell(hfile);
    fseek(hfile, 0, SEEK_SET);
    //申请imagebuffer
    char* newbuffer = NULL;
    if (0 != judge)
    {
        newbuffer = (char*)malloc(size_filebuffer+ size);
        if (NULL == newbuffer)
        {
            printf("申请newbuffer错误\n");
            return 0;
        }
        //初始化iamgebuffer
        memset(newbuffer, 0, size_filebuffer+ size);
    }
    else
    {
        newbuffer = (char*)malloc(size_filebuffer);
        if (NULL == newbuffer)
        {
            printf("申请newbuffer错误\n");
            return 0;
        }
        //初始化iamgebuffer
        memset(newbuffer, 0, size_filebuffer);
    }
    //开始还原
    //1 copy头和节表
    memcpy(newbuffer, imagebuffer, f_nt_headers->OptionalHeader.SizeOfHeaders);
    //2 copy节
    DWORD number_section = f_nt_headers->FileHeader.NumberOfSections;
    while (number_section--)
    {
        memcpy(newbuffer + f_section_header->PointerToRawData, imagebuffer + f_section_header->VirtualAddress, f_section_header->SizeOfRawData);
        f_section_header++;
    }
    return newbuffer;
}

void savebuffer(char* buffer,int judge, DWORD size)
{
    FILE* hfile1 = fopen(FILENAME_ONE, "rb+");
    //计算hfile的大小
    fseek(hfile1, 0, SEEK_END);
    long size_file = 0;
    if (0 != judge)
    {
        size_file = ftell(hfile1)+ size;
    }
    else
    {
        size_file = ftell(hfile1);
    }
    fseek(hfile1, 0, SEEK_SET);
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(buffer);
    FILE* savebuffer_add=fopen(BUFFERNAME, "wb+");
    fseek(savebuffer_add, 0, SEEK_SET);
    if (NULL==savebuffer_add)
    {
        printf("打开BUFFERNAME失败\n");
        return;
    }
    fwrite(buffer, size_file, 1, savebuffer_add);
    printf("存盘成功\n");                      //大部分存完盘后直接退出，所以这里加free
    fclose(savebuffer_add);
    return;
}

char* shellcodetoimagebuffer(char* imagebuffer)
{
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(imagebuffer);
    //得到节表
    PIMAGE_SECTION_HEADER f_section_header = (PIMAGE_SECTION_HEADER)((DWORD)f_nt_headers + 24 + (DWORD)f_nt_headers->FileHeader.SizeOfOptionalHeader);
    //得到节的数量并找到可运行shellcode的节
    short number_section = f_nt_headers->FileHeader.NumberOfSections;
    while (number_section--)
    {
        if (0x80000020 == f_section_header->Characteristics)
        {
            //判断该节是否够加入shellcode
            if (f_section_header->SizeOfRawData - f_section_header->Misc.VirtualSize < SHELLCODE)
            {
                printf("该节剩下的空间不够存储shellcode\n");
                if (0 == number_section)
                {
                    printf("该文件没有想要的内存存储shellcode\n");
                    return 0;
                }
            }
            else
            {
                break;
            }
        }
        f_section_header++;
    }
    //找到该节的空白位置并写入初始化的shellcode
    char* section_shellcode = imagebuffer + FOAtoRVA(imagebuffer, f_section_header->PointerToRawData + f_section_header->Misc.VirtualSize);
    memcpy(section_shellcode, shellcode, SHELLCODE);
    DWORD EntryPoint = (DWORD)section_shellcode - (DWORD)imagebuffer;
    //修改E8   0x77A9ED60   MessageBoxA
    section_shellcode = section_shellcode + 9;
    *(int*)section_shellcode = 0X777AED60 - (DWORD)(f_nt_headers->OptionalHeader.ImageBase+FOAtoRVA(imagebuffer, f_section_header->PointerToRawData + f_section_header->Misc.VirtualSize) + 13);
    //修改E9
    section_shellcode = section_shellcode + 5;
    *(int*)section_shellcode = (DWORD)(f_nt_headers->OptionalHeader.ImageBase + f_nt_headers->OptionalHeader.AddressOfEntryPoint - (DWORD)(f_nt_headers->OptionalHeader.ImageBase + FOAtoRVA(imagebuffer, f_section_header->PointerToRawData + f_section_header->Misc.VirtualSize) + 18));
    //修改AddressOfEntryPoint
    f_nt_headers->OptionalHeader.AddressOfEntryPoint = EntryPoint;
    return imagebuffer;
}

void print_PE()
{
    printf("打印DOS头请按1，\n打印FILE头请按2，\n打印OPTIONAL头请按3，\n打印节表请按4，\n打印输出表请按5，\n打印重定位表请按7");
    FILE* hfile = fopen(FILENAME_ONE, "rb+");
    if (NULL == hfile)
    {
        printf("请输入正确的地址\n");
        return;
    }
    char* filebuffer = FILEtoBUFFER(hfile);
    if (FALSE == judgePE(filebuffer))
    {
        fclose(hfile);
        return;
    }
    int i = 0;
    scanf("%d", &i);
    switch (i)
    {
    //case 1:print_DOS(filebuffer); break;
    //case 2:print_FILE(filebuffer); break;
    //case 3:print_OPTIONAL(filebuffer); break;
    //case 4:print_SECTIONS(filebuffer); break;
    }
}

char* increase_section(char* imagebuffer, DWORD size)
{
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(imagebuffer);
    //得到节表
    PIMAGE_SECTION_HEADER f_section_header = (PIMAGE_SECTION_HEADER)((DWORD)f_nt_headers + 24 + (DWORD)f_nt_headers->FileHeader.SizeOfOptionalHeader);
    //得到节的数量
    short number_section = f_nt_headers->FileHeader.NumberOfSections;
    //得到最后一个节
    PIMAGE_SECTION_HEADER use_section = f_section_header + number_section - 1;
    //得到最后一个节在内存中对齐后的大小
    DWORD use_section_misc = 0;
    if (0 == use_section->Misc.VirtualSize % 0x1000)
    {
        use_section_misc = use_section->Misc.VirtualSize;
    }
    else
    {
        use_section_misc = 0x1000 * (use_section->Misc.VirtualSize / 0x1000 + 1);
    }
    //得到最后一个节在内存中的偏移和大小
    DWORD use_section_pointertorawdata = use_section->PointerToRawData;
    DWORD use_section_sizeodrawdata = use_section->SizeOfRawData;
    //得到添加节的地址
    PIMAGE_SECTION_HEADER increase_section_add = f_section_header + number_section;
    //判断是否够添加节
    if (f_section_header->PointerToRawData - ((DWORD)increase_section_add -(DWORD)imagebuffer) < 80)
    {
        printf("剩下的内存不够添加新节\n");
        return 0;
    }
    //给节增加信息
    memcpy(increase_section_add->Name, "jinsen", 7);//节的名字
    increase_section_add->Misc.VirtualSize = size;//节在内存中展开后的实际大小
    increase_section_add->VirtualAddress = use_section->VirtualAddress + use_section_misc;//得到在内存中的偏移
    increase_section_add->SizeOfRawData = size;//在文件中对齐的尺寸
    increase_section_add->PointerToRawData = use_section_pointertorawdata + use_section_sizeodrawdata;//得到在文件中的偏移
    increase_section_add->Characteristics = 0x80000020;
    //修改文件节的数量
    f_nt_headers->FileHeader.NumberOfSections = f_nt_headers->FileHeader.NumberOfSections + 1;
    //修改sizeofimage
    f_nt_headers->OptionalHeader.SizeOfImage = f_nt_headers->OptionalHeader.SizeOfImage + size;
    return imagebuffer;
}

void move_export_directory(char* filebuffer)
{
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(filebuffer);
    //得到节表
    PIMAGE_SECTION_HEADER f_section_header = (PIMAGE_SECTION_HEADER)((DWORD)f_nt_headers + 24 + (DWORD)f_nt_headers->FileHeader.SizeOfOptionalHeader);
    //得到节的数量
    short number_section = f_nt_headers->FileHeader.NumberOfSections;
    //得到最后一个节
    PIMAGE_SECTION_HEADER use_section = f_section_header + number_section - 1;
    //得到输出表
    PIMAGE_EXPORT_DIRECTORY f_export_directory = Get_Export_directory(filebuffer);
    if (0 == f_export_directory)
    {
        printf("错误              Get_Export_directory\n");
        return;
    }
    //开始移动
    //1 移动函数地址表
    char* move_start_add = filebuffer + use_section->PointerToRawData;//得到移动的起始地址
    char* function_add_backup = move_start_add;
    char* f_function_add_table = filebuffer + RVAtoFOA(filebuffer, f_export_directory->AddressOfFunctions);//得到函数地址表的地址
    DWORD size_byte_function = f_export_directory->NumberOfFunctions * 4;//得到函数地址的大小
    memcpy(move_start_add, f_function_add_table, size_byte_function);//成功
    //2 移动函数序号表
    move_start_add = move_start_add + size_byte_function;//得到移动的起始地址
    char* ordinal_add_backup = move_start_add;
    char* f_function_ordinal = filebuffer + RVAtoFOA(filebuffer, f_export_directory->AddressOfNameOrdinals);//得到函数序号表地址
    DWORD size_byte_ordinal = f_export_directory->NumberOfNames * 2;//得到序号表的大小
    memcpy(move_start_add, f_function_ordinal, size_byte_ordinal);//成功
    //3 移动函数名称表  
    move_start_add = move_start_add + size_byte_ordinal;//得到移动的起始地址   名字地址
    char* name_add_backup = move_start_add;//备份，用于同时进行复制名字的同时修改名字的地址
    char* name_add_backup_two = move_start_add;//二次备份
    int* f_function_name = (int*)(filebuffer + RVAtoFOA(filebuffer, f_export_directory->AddressOfNames));//得到函数名称表的地址
    DWORD size_byte_function_name = f_export_directory->NumberOfNames * 4;//得到名称表的大小
    memcpy(move_start_add, f_function_name, size_byte_function_name);//成功
    DWORD number_function_name = f_export_directory->NumberOfNames;//得到名字函数的数量
    move_start_add = move_start_add + size_byte_function_name;//得到移动的起始地址    名字
    while (number_function_name--)//移一个名字换一个地址
    {
        char* function_name_add = filebuffer + RVAtoFOA(filebuffer, *f_function_name++);//得到函数名字的地址
        DWORD size_name = strlen(function_name_add) + 1;//得到函数名字的大小
        memcpy(move_start_add, function_name_add, size_name);//成功
        DWORD function_name_rva = FOAtoRVA(filebuffer, (DWORD)move_start_add - (DWORD)filebuffer);//把foa转换成rva
        int move_second[1] = { function_name_rva };
        memcpy(name_add_backup, move_second, 4);//修改函数名字的地址                               ！！！！RVA
        name_add_backup = name_add_backup + 4;
        move_start_add = move_start_add + size_name;//得到下一个名字移动的起始地址
    }
    //4 移动输出表
    memcpy(move_start_add, f_export_directory,40);
    //5 修改导出表的地址
    f_nt_headers->OptionalHeader.DataDirectory[0].VirtualAddress = FOAtoRVA(filebuffer, (DWORD)move_start_add - (DWORD)filebuffer);
    //6 修改导出表中内容的地址
    PIMAGE_EXPORT_DIRECTORY senond_export_directory = (PIMAGE_EXPORT_DIRECTORY)move_start_add;
    senond_export_directory->AddressOfFunctions = FOAtoRVA(filebuffer, (DWORD)function_add_backup - (DWORD)filebuffer);
    senond_export_directory->AddressOfNameOrdinals= FOAtoRVA(filebuffer, (DWORD)ordinal_add_backup - (DWORD)filebuffer);
    senond_export_directory->AddressOfNames= FOAtoRVA(filebuffer, (DWORD)name_add_backup_two - (DWORD)filebuffer);

    memset(f_export_directory, 0, 40);//把原来的导出表置零

}

void move_base_relocation(char* filebuffer)
{
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(filebuffer);
    //得到节表
    PIMAGE_SECTION_HEADER f_section_header = (PIMAGE_SECTION_HEADER)((DWORD)f_nt_headers + 24 + (DWORD)f_nt_headers->FileHeader.SizeOfOptionalHeader);
    //得到节的数量
    short number_section = f_nt_headers->FileHeader.NumberOfSections;
    //得到最后一个节
    PIMAGE_SECTION_HEADER use_section = f_section_header + number_section - 1;
    //得到该节的文件对齐地址
    char* use_section_foa_add = filebuffer+use_section->PointerToRawData;
    //得到重定位表地址
    char* f_base_relocation_add = filebuffer + RVAtoFOA(filebuffer, f_nt_headers->OptionalHeader.DataDirectory[5].VirtualAddress);
    PIMAGE_BASE_RELOCATION f_base_relocation = (PIMAGE_BASE_RELOCATION)f_base_relocation_add;
    //遍历得到重定位表的大小
    DWORD size_all_base = 0;//记录
    char* f_base_relocation_backup = (char*)f_base_relocation;//备份
    while (0 != f_base_relocation->SizeOfBlock && 0 != f_base_relocation->VirtualAddress)
    {
        size_all_base = size_all_base + f_base_relocation->SizeOfBlock;
        f_base_relocation = (PIMAGE_BASE_RELOCATION)((unsigned long)f_base_relocation + f_base_relocation->SizeOfBlock);
    }
    //移动重定位表
    memcpy(use_section_foa_add, f_base_relocation_backup, size_all_base);
    //修改重定位表地址
    f_nt_headers->OptionalHeader.DataDirectory[5].VirtualAddress = FOAtoRVA(filebuffer, (DWORD)use_section_foa_add - (DWORD)filebuffer);
    //原来的重定位表置零
    memset(f_base_relocation_backup, 0, size_all_base);
}

char* modify_imagebase(char* filebuffer, DWORD newimagebase)
{
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(filebuffer);
    //得到重定位表地址
    char* f_base_relocation_add = filebuffer + RVAtoFOA(filebuffer, f_nt_headers->OptionalHeader.DataDirectory[5].VirtualAddress);//得到重定位表的foa地址
    PIMAGE_BASE_RELOCATION f_base_relocation = (PIMAGE_BASE_RELOCATION)f_base_relocation_add;//得到重定位表结构体
    while (0 != f_base_relocation->SizeOfBlock && 0 != f_base_relocation->VirtualAddress)
    {
        unsigned long number_of_add = (f_base_relocation->SizeOfBlock - 8) / 2;//得到每个块中地址的数量
        //得到地址
        short* twobyte_add = (short*)f_base_relocation + 4;//得到地址的首地址，因为是short*类型,这里加4等于加8
        while (number_of_add--)//遍历这个块
        {
            short twobyte_value = *(twobyte_add);//得到指针中的值
            if (3 == twobyte_value >> 12)
            {
                twobyte_value = twobyte_value & 0x0fff;//去掉前面的属性
                int* forebyte_add = (int*)(filebuffer + RVAtoFOA(filebuffer, twobyte_value + f_base_relocation->VirtualAddress));//得到在文件中的地址
                *forebyte_add = *forebyte_add + newimagebase - f_nt_headers->OptionalHeader.ImageBase;//取值并修改
            }
            twobyte_add++;
        }
        f_base_relocation = (PIMAGE_BASE_RELOCATION)((unsigned long)f_base_relocation + f_base_relocation->SizeOfBlock);//得到下一个块的首地址
    }
    f_nt_headers->OptionalHeader.ImageBase = newimagebase;//更改为新的imagebase
    return filebuffer;
}

PIMAGE_IMPORT_DESCRIPTOR Get_Import_descrtiptor(char* buffer)
{
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(buffer);
    //得到输出表地址
    unsigned long import_add = f_nt_headers->OptionalHeader.DataDirectory[1].VirtualAddress;
    unsigned long import_add_foa = RVAtoFOA(buffer, import_add);
    //得到输出表
    PIMAGE_IMPORT_DESCRIPTOR f_import_descriptor = (PIMAGE_IMPORT_DESCRIPTOR)((unsigned long)buffer + (unsigned long)import_add_foa);
    return f_import_descriptor;
}

void print_import_descriptor(char* buffer)
{
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(buffer);
    //得到导入表FOA地址
    PIMAGE_IMPORT_DESCRIPTOR f_import_descriptor = Get_Import_descrtiptor(buffer);
    int i = 1;
    while (0 != f_import_descriptor->FirstThunk && 0 != f_import_descriptor->Name && 0 != f_import_descriptor->OriginalFirstThunk)
    {
        //得到dll的名字
        char* dll_name_add = buffer+ RVAtoFOA(buffer,f_import_descriptor->Name);
        printf("***************************************************\n");
        printf("第%2d个dll的名字是%s\n\n", i++, dll_name_add);
        //得到INT的地址
        int* int_add= (int*)(buffer + RVAtoFOA(buffer, f_import_descriptor->OriginalFirstThunk));
        //得到IAT的地址
        int* iat_add= (int*)(buffer + RVAtoFOA(buffer, f_import_descriptor->FirstThunk));
        int m = 1;
        printf("******************OriginalFirstThunk*******************\n");
        while (0 != *(int_add))
        {
            if (*(int_add) & 0x80000000)
            {
                printf("第%d个函数没有名字，其索引为：%x\n)", m++, *(int_add) & 0x7FFFFFFF);
            }
            else
            {
                PIMAGE_IMPORT_BY_NAME f_pimage_import_by_name = (PIMAGE_IMPORT_BY_NAME)(buffer + RVAtoFOA(buffer, *(int_add)));
                printf("第%2d个函数的名字为：%s\n", m++, f_pimage_import_by_name->Name);
            }
            int_add++;
        }

        int n = 1;
        printf("******************FirstThunk*******************\n");
        while (0 != *(iat_add))
        {
            if (*(iat_add) & 0x80000000)
            {
                printf("第%d个函数没有名字，其索引为：%x\n)", n++, *(iat_add) & 0x7FFFFFFF);
            }
            else
            {
                PIMAGE_IMPORT_BY_NAME f_pimage_import_by_name = (PIMAGE_IMPORT_BY_NAME)(buffer + RVAtoFOA(buffer, *(iat_add)));
                printf("第%2d个函数的名字为：%s\n", n++, f_pimage_import_by_name->Name);
            }
            iat_add++;
        }
        f_import_descriptor++;
    }
}

PIMAGE_BOUND_IMPORT_DESCRIPTOR Get_Bound_import_descriptor(char* buffer)
{
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(buffer);
    //得到输出表地址
    unsigned long bound_import_descriptor_add = f_nt_headers->OptionalHeader.DataDirectory[11].VirtualAddress;
    unsigned long bound_import_descriptor_add_foa = RVAtoFOA(buffer, bound_import_descriptor_add);
    //得到输出表
    PIMAGE_BOUND_IMPORT_DESCRIPTOR f_bound_import_descriptor = (PIMAGE_BOUND_IMPORT_DESCRIPTOR)((unsigned long)buffer + (unsigned long)bound_import_descriptor_add_foa);
    return f_bound_import_descriptor;

}

void print_bound_import_descriptor(char* buffer)
{
    //得到PE头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(buffer);
    //得到绑定导入表FOA地址
    PIMAGE_IMPORT_DESCRIPTOR f_import_descriptor = Get_Import_descrtiptor(buffer);
    int i = 1;
    //遍历看是否有绑定导入表
    while (0 != f_import_descriptor->FirstThunk && 0 != f_import_descriptor->Name && 0 != f_import_descriptor->OriginalFirstThunk)
    {
        if (-1 == f_import_descriptor->TimeDateStamp)
        {
            printf("有绑定导入表\n");         //得到绑定导入表
            PIMAGE_BOUND_IMPORT_DESCRIPTOR f_bound_import_descriptor = Get_Bound_import_descriptor(buffer);
            DWORD f_bound_import_descriptor_backup = (DWORD)f_bound_import_descriptor;
            while (0 != f_bound_import_descriptor->TimeDateStamp && 0 != f_bound_import_descriptor->OffsetModuleName)
            {
                printf("****************一级*****************\n");
                printf("TimeDateStamp      %x\n", f_bound_import_descriptor->TimeDateStamp);
                printf("Name               %s\n", f_bound_import_descriptor->OffsetModuleName + f_bound_import_descriptor_backup);
                printf("NumberOfDll        %d\n", f_bound_import_descriptor->NumberOfModuleForwarderRefs);
                if (0 != f_bound_import_descriptor->NumberOfModuleForwarderRefs)
                {
                    int n = f_bound_import_descriptor->NumberOfModuleForwarderRefs;
                    while (n--)
                    {
                        PIMAGE_BOUND_FORWARDER_REF f_bound_ref = (PIMAGE_BOUND_FORWARDER_REF)++f_bound_import_descriptor;
                        printf("****************二级*****************\n");
                        printf("TimeDateStamp      %x\n", f_bound_ref->TimeDateStamp);
                        printf("Name               %s\n", f_bound_ref->OffsetModuleName + f_bound_import_descriptor_backup);
                        printf("Reserved           %d\n\n", f_bound_ref->Reserved);
                    }
                }
                f_bound_import_descriptor++;
            }
            break;
        }
        f_import_descriptor++;
        if (0 == f_import_descriptor->FirstThunk && 0 == f_import_descriptor->Name && 0 == f_import_descriptor->OriginalFirstThunk)
        {
            printf("该PE文件没有绑定重定位表\n");
        }
    }
}

void move_import_descriptor(char* filebuffer)//移动导入表到新节中并加入新导入表
{
    //得到NT头
    PIMAGE_NT_HEADERS f_nt_headers = GET_nt_header(filebuffer);
    //得到导入表
    PIMAGE_IMPORT_DESCRIPTOR f_import_descriptor = Get_Import_descrtiptor(filebuffer);
    //备份导入表
    PIMAGE_IMPORT_DESCRIPTOR f_import_descriptor_bakup = f_import_descriptor;
    //得到节表
    PIMAGE_SECTION_HEADER f_section_header = (PIMAGE_SECTION_HEADER)((DWORD)f_nt_headers + 4 + 20 + (DWORD)f_nt_headers->FileHeader.SizeOfOptionalHeader);
    //得到节的数量
    char number_sections = f_nt_headers->FileHeader.NumberOfSections;
    //得到最后一个节表的位置
    f_section_header = f_section_header + number_sections - 1;
    //得到最后一个节在文件中的起始地址
    char* last_section_add = filebuffer + f_section_header->PointerToRawData;
    //最后一个节是自己弄的，所有内存肯定够，这里就不判断内存够不够了
    //移动导入表
    //1遍历导入表的数量
    int i = 0;
    while (0 != f_import_descriptor->FirstThunk && 0 != f_import_descriptor->OriginalFirstThunk)
    {
        i++;
        f_import_descriptor++;
    }
    memcpy(last_section_add, f_import_descriptor_bakup, 20 * i);//移动
    memset(f_import_descriptor_bakup, 0, 20 * i);//原来的导入表置零
    //修改optional目录中的地址
    f_nt_headers->OptionalHeader.DataDirectory[1].VirtualAddress = FOAtoRVA(filebuffer, f_section_header->PointerToRawData);

    //**************************注入导入表*********************************
    //得到位置注入
    PIMAGE_IMPORT_DESCRIPTOR new_import_descriptor = (PIMAGE_IMPORT_DESCRIPTOR)last_section_add + i;
    //得到int表的位置
    int* new_int_table_add = (int*)(last_section_add + 20 * (i + 2));
    //得到iat表的位置
    int* new_iat_table_add = new_int_table_add + 2;
    //得到PIMAGE_IMPORT_BY_NAME位置  int
    PIMAGE_IMPORT_BY_NAME new_int_table = (PIMAGE_IMPORT_BY_NAME)(new_iat_table_add + 2);
    *new_int_table_add= FOAtoRVA(filebuffer, (DWORD)new_int_table - (DWORD)filebuffer);//这里直接把PIMAGE_IMPORT_BY_NAME(int)的地址给int表
    //得到PIMAGE_IMPORT_BY_NAME位置  iat
    PIMAGE_IMPORT_BY_NAME new_iat_table = (PIMAGE_IMPORT_BY_NAME)(new_iat_table_add + 7);
    *new_iat_table_add = FOAtoRVA(filebuffer, (DWORD)new_iat_table - (DWORD)filebuffer);//这里直接把PIMAGE_IMPORT_BY_NAME(iat)的地址给iat表
    //名字地址   (char*)(new_iat_table + 5)
    char* dll_name_add = (char*)(new_iat_table_add + 12);
    const char* dll_name = "textdll.dll";
    memcpy(dll_name_add, dll_name, 12);
    //写入dll内容
    new_import_descriptor->OriginalFirstThunk = FOAtoRVA(filebuffer, (DWORD)new_int_table_add - (DWORD)filebuffer);//注意！！！int表中存的是PIMAGE_IMPORT_BY_NAME的位置，不是PIMAGE_IMPORT_BY_NAME结构体。
    new_import_descriptor->FirstThunk = FOAtoRVA(filebuffer, (DWORD)new_iat_table_add - (DWORD)filebuffer);//注意！！！iat表中存的是PIMAGE_IMPORT_BY_NAME的位置，不是PIMAGE_IMPORT_BY_NAME结构体。
    new_import_descriptor->TimeDateStamp = 0;
    new_import_descriptor->Name= FOAtoRVA(filebuffer, (DWORD)dll_name_add - (DWORD)filebuffer);
    //写入int内容
    new_int_table->Hint = 0;
    const char* function_name = "process";
    memcpy(new_int_table->Name, function_name, 8);
    //写入iat内容
    new_iat_table->Hint = 0;
    memcpy(new_iat_table->Name, function_name, 8);
}

2262343003

没人啊