仿真WINDOWS PE加载器的程序

小鱼儿 2022-09-19 08:19 319阅读 0赞

此程序用来仿真PE加载器，可以直接运行内存中的程序。   
  
bool PELoader(char \*lpStaticPEBuff, long lStaticPELen)  
\{   
 long lPESignOffset = \*(long \*)(lpStaticPEBuff + 0x3c);  
 IMAGE\_NT\_HEADERS \*pINH = (IMAGE\_NT\_HEADERS \*)(lpStaticPEBuff + lPESignOffset);  
  
 //取加载到内存中大小  
 long lImageSize = pINH->OptionalHeader.SizeOfImage;  
 char \*lpDynPEBuff = new char\[lImageSize\];  
 if(lpDynPEBuff == NULL)  
 \{   
 return false;  
 \}  
 memset(lpDynPEBuff, 0, lImageSize);  
  
 //取PE文件的节数量  
 long lSectionNum = pINH->FileHeader.NumberOfSections;  
  
 //计算PE头信息及节表信息占用内存大小  
 long lPEHeadSize = lPESignOffset + sizeof(IMAGE\_NT\_HEADERS) + lSectionNum \* sizeof(IMAGE\_SECTION\_HEADER);  
  
 //加载PE头部信息及其各个节表  
 memcpy(lpDynPEBuff, lpStaticPEBuff, lPEHeadSize);  
  
 //加载各个节  
 long lFileAlignMask = pINH->OptionalHeader.FileAlignment - 1; //各节在磁盘中的对齐掩码  
 long lSectionAlignMask = pINH->OptionalHeader.SectionAlignment - 1; //各节在load后内存中的对齐掩码  
 IMAGE\_SECTION\_HEADER \*pISH = (IMAGE\_SECTION\_HEADER \*)((char \*)pINH + sizeof(IMAGE\_NT\_HEADERS));  
 for(int nIndex = 0; nIndex < lSectionNum; nIndex++, pISH++)  
 \{   
 //判定各节的对齐属性，合法不  
 if((pISH->VirtualAddress & lSectionAlignMask) || (pISH->SizeOfRawData & lFileAlignMask))  
 \{   
 //出现非法节  
 delete lpDynPEBuff;  
 return false;  
 \}  
  
 //加载改节  
 memcpy(lpDynPEBuff + pISH->VirtualAddress, lpStaticPEBuff + pISH->PointerToRawData, pISH->SizeOfRawData);  
 \}  
  
 //修改导入表，导入程序执行过程中要用到的API函数地址  
 if(pINH->OptionalHeader.DataDirectory\[IMAGE\_DIRECTORY\_ENTRY\_IMPORT\].Size > 0) //大于0说明有导入表  
 \{   
 IMAGE\_IMPORT\_DESCRIPTOR \*pIID = (IMAGE\_IMPORT\_DESCRIPTOR \*)(lpDynPEBuff + /  
 pINH->OptionalHeader.DataDirectory\[IMAGE\_DIRECTORY\_ENTRY\_IMPORT\].VirtualAddress);  
  
 //循环扫描每个将有函数导入的dll  
 for(; pIID->Name != NULL; pIID++)  
 \{   
 /\*曾看过OllyDump源代码，那里在重建导入表的时候，并没有初始化OriginalFirstThunk这个字段,  
 所以这里也不对OriginalFirstThunk这个字段进行处理了\*/  
 IMAGE\_THUNK\_DATA \*pITD = (IMAGE\_THUNK\_DATA \*)(lpDynPEBuff + pIID->FirstThunk);  
  
 HINSTANCE hInstance = LoadLibrary(lpDynPEBuff + pIID->Name);  
 if(hInstance == NULL)  
 \{   
 //导入这个dll失败  
 delete lpDynPEBuff;  
 return false;  
 \}  
  
 //循环扫描dll内每个被导入函数  
 for(; pITD->u1.Ordinal != 0; pITD++)  
 \{   
 FARPROC fpFun;  
 if(pITD->u1.Ordinal & IMAGE\_ORDINAL\_FLAG32)  
 \{   
 //函数是以序号的方式导入的  
 fpFun = GetProcAddress(hInstance, (LPCSTR)(pITD->u1.Ordinal & 0x0000ffff));  
 \}  
 else  
 \{   
 //函数是以名称方式导入的  
 IMAGE\_IMPORT\_BY\_NAME \* pIIBN = (IMAGE\_IMPORT\_BY\_NAME \*)(lpDynPEBuff + pITD->u1.Ordinal);  
 fpFun = GetProcAddress(hInstance, (LPCSTR)pIIBN->Name);  
 \}  
  
 if(fpFun == NULL)  
 \{   
 //导出这个函数失败  
 delete lpDynPEBuff;  
 return false;  
 \}  
  
 pITD->u1.Ordinal = (long)fpFun;  
 \}  
  
 FreeLibrary(hInstance);  
 \}  
 \}  
  
  
 //重定位处理  
 if(pINH->OptionalHeader.DataDirectory\[IMAGE\_DIRECTORY\_ENTRY\_BASERELOC\].Size > 0)  
 \{   
 //取第一个重定位块  
 IMAGE\_BASE\_RELOCATION \*pIBR = (IMAGE\_BASE\_RELOCATION \*)(lpDynPEBuff + /  
 pINH->OptionalHeader.DataDirectory\[IMAGE\_DIRECTORY\_ENTRY\_BASERELOC\].VirtualAddress);  
  
 long lDifference = (long)lpDynPEBuff - pINH->OptionalHeader.ImageBase;  
  
 //循环每个重定位块  
 for(; pIBR->VirtualAddress != 0; )  
 \{   
 char \*lpMemPage = lpDynPEBuff + pIBR->VirtualAddress;  
 long lCount = (pIBR->SizeOfBlock - sizeof(IMAGE\_BASE\_RELOCATION)) >> 1;  
  
 //对这个页面中的每个需重定位的项进行处理  
 short int \*pRelocationItem = (short int \*)((char \*)pIBR + sizeof(IMAGE\_BASE\_RELOCATION));  
 for(int nIndex = 0; nIndex < lCount; nIndex++)  
 \{   
 int nOffset = pRelocationItem\[nIndex\] &0x0fff;  
 int nType = pRelocationItem\[nIndex\] >> 12;  
  
 //虽然windows定义了很多重定位类型，但是在PE文件中只能见到0和3两种  
 if(nType == 3)  
 \{   
 \*(long \*)(lpDynPEBuff + nOffset) += lDifference;  
 \}  
 else if(nType == 0)  
 \{   
 //什么也不做  
 \}  
 \}  
  
 //pIBR指向下一个重定位块  
 pIBR = (IMAGE\_BASE\_RELOCATION \*)(pRelocationItem + lCount);  
 \}  
  
 \}  
  
 delete lpDynPEBuff;  
  
 return true;  
\}