放下代码 PE文件变形之初步移动PE头-优快云博客

本文链接：https://blog.youkuaiyun.com/dyan08/article/details/24963235

本文介绍了一个使用汇编语言编写的程序，该程序能够检测指定的文件是否为PE（Portable Executable）格式，并在确认后进行头部信息的移动操作。程序首先尝试打开目标文件并读取其内容，接着通过检查特定的标识来判断文件类型。如果文件被确认为PE格式，程序将调整文件的头部信息。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

程序代码

.386

.model flat,stdcall
option casemap:none
include windows.inc
include user32.inc
include kernel32.inc
include gdi32.inc
includelib gdi32.lib
includelib user32.lib
includelib kernel32.lib
Message  proto :DWORD
movfile proto  :dword,:dword,:dword
IsPeFile proto :dword
MovPeHead proto :dword,:dword,:dword
.data

     szFileName db "E:\stu1\stu2\bin\Debug\main.exe",0
     szEorro    db "file open fail",0
     szCaption  db "PEêμÑé",0
     szsuccesful db "successful!",0
     szpe    db "this is a pe file",0
     szPeMovNo  db "ÎÄ¼t2»DèòaòÆ¶ˉ",0
     szNoPe     db "this is not PE file",0
.data?
     hFileHanld dword ?
     szbuff  dword 4096 dup (?)
     szreadnum dword ?
     szbuff1    IMAGE_DOS_HEADER <>
     dwPeRav    dword ?

.code
     start:

            invoke CreateFile,offset szFileName,GENERIC_READ or GENERIC_WRITE,NULL,NULL,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL
            .IF eax==INVALID_HANDLE_VALUE
                invoke MessageBox,NULL,offset szEorro,offset szCaption,MB_OK
                invoke ExitProcess,NULL
            .endif

            mov hFileHanld ,eax
            invoke ReadFile,hFileHanld,offset szbuff, 0400h,offset szreadnum,NULL
            invoke IsPeFile,offset szbuff
            .if eax==0
                invoke MessageBox,NULL,szNoPe,NULL,MB_OK
                jmp over
            .endif
            mov dwPeRav,eax
            invoke MovPeHead,offset szbuff,0ch,dwPeRav

            invoke SetFilePointer,hFileHanld,0,0,FILE_BEGIN
            invoke WriteFile,hFileHanld,offset szbuff,400h,NULL,NULL



         over:
            invoke ExitProcess,NULL
           Message proc lpstring:dword

               invoke MessageBox,NULL,lpstring,offset szCaption,MB_OK
               ret

           Message endp
          movfile proc  dst:dword,src:dword,sizelen:dword

              mov edi,dst
              mov esi,src
              mov ecx,sizelen
          next:    movsb
              mov byte ptr [esi-1],0
              loop next
              ret

          movfile endp
          IsPeFile proc lpbuff:dword
              mov esi,lpbuff
              mov eax,0
              assume esi : ptr IMAGE_DOS_HEADER
              .IF [esi].e_magic=="ZM"
                  mov esi,[esi].e_lfanew
                  add esi,lpbuff
                  .if word ptr [esi]=="EP"
                      invoke Message ,offset szpe
                      sub esi,lpbuff
                      mov eax,esi
                  .endif

              .endif

              assume esi : nothing
              ret

          IsPeFile endp

         MovPeHead proc lpDosHead :dword,dwPosition : DWORD,dwPeRav1 :dword
             mov eax,dwPeRav1
             .if dwPosition==eax
                 invoke MessageBox,NULL,offset szPeMovNo,NULL,MB_OK
                 ret
             .endif
              mov esi,lpDosHead
              push esi
              assume esi:ptr IMAGE_DOS_HEADER
              mov esi,[esi].e_lfanew
              add esi,lpDosHead
              assume esi:nothing
              assume esi:ptr IMAGE_NT_HEADERS
              mov  dx,[esi].FileHeader.NumberOfSections
              movzx edx,dx
              mov eax,sizeof(IMAGE_SECTION_HEADER)
              MUL edx
              add eax,sizeof(IMAGE_NT_HEADERS)
              assume esi : nothing
              mov ebx,lpDosHead
              add ebx,dwPosition
              invoke movfile,ebx,esi,eax
              pop esi
              assume esi : ptr IMAGE_DOS_HEADER
              mov eax,dwPosition
              mov [esi].e_lfanew,eax
              assume esi:nothing
              ret
         MovPeHead endp
     end start