移动重定位表和模拟windows重定位过程

移动重定位表

思路

大体上和移动导出表相同，相比而言简单一些，不用寻址三个表。直接复制重定位表的内容即可。可以参照我写的移动导出表的那一篇博文。

代码

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

DWORD RVATOFOA(DWORD RVA,LPVOID pFileBuffer)
{
   
    DWORD FOA = NULL;
    PIMAGE_DOS_HEADER pDosHeader = NULL;
    PIMAGE_NT_HEADERS pNtHeaders = NULL;
    PIMAGE_FILE_HEADER pFileHeader = NULL;
    PIMAGE_OPTIONAL_HEADER pOptionalHeader = NULL;
    PIMAGE_SECTION_HEADER pSectionHeader = NULL;

    pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
    pNtHeaders = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew);
    pFileHeader = (PIMAGE_FILE_HEADER)((DWORD)pNtHeaders + 4);
    pOptionalHeader = (PIMAGE_OPTIONAL_HEADER)((DWORD)pFileHeader + IMAGE_SIZEOF_FILE_HEADER);
    pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionalHeader + pFileHeader->SizeOfOptionalHeader);
    if(RVA <= pOptionalHeader->SizeOfHeaders)
        return RVA;
    for(;RVA >(pSectionHeader->Misc.VirtualSize  + pSectionHeader->VirtualAddress);pSectionHeader++);//定位到所在的节
    FOA = RVA - pSectionHeader->VirtualAddress + pSectionHeader->PointerToRawData;
    return FOA;
}
DWORD FOATORVA(DWORD FOA,LPVOID pFileBuffer)
{
   
    DWORD RVA = NULL;
    PIMAGE_DOS_HEADER pDosHeader = NULL;
    PIMAGE_NT_HEADERS pNtHeaders = NULL;
    PIMAGE_FILE_HEADER pFileHeader = NULL;
    PIMAGE_OPTIONAL_HEADER pOptionalHeader = NULL;
    PIMAGE_SECTION_HEADER pSectionHeader = NULL;

    pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
    pNtHeaders = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew);
    pFileHeader = (PIMAGE_FILE_HEADER)((DWORD)pNtHeaders + 4);
    pOptionalHeader = (PIMAGE_OPTIONAL_HEADER)((DWORD)pFileHeader + IMAGE_SIZEOF_FILE_HEADER);
    pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionalHeader + pFileHeader->SizeOfOptionalHeader);
    if(FOA <= pOptionalHeader->SizeOfHeaders)
        return RVA;
    for(;FOA>(pSectionHeader->SizeOfRawData + pSectionHeader->PointerToRawData);pSectionHeader++);//定位到所在的节
    RVA = FOA - pSectionHeader->PointerToRawData + pSectionHeader->VirtualAddress;
    return RVA;

}


LPVOID ReadPEFile(LPSTR lpszFile)//读取文件
{
   
    FILE *pFile = NULL;//文件流
    DWORD fileSize = 0;//文件大小
    LPVOID pFileBuffer = NULL;//文件存储的缓冲区

    //打开文件
    pFile  = fopen(lpszFile,"rb");
    if(!pFile)
    {
   
        printf("无法打开exe文件！");
        return NULL;
    }
    //读取文件的大小
    //SEEK_SET： 文件开头SEEK_CUR： 当前位置；SEEK_END： 文件结尾
    fseek(pFile,0L,SEEK_END);//fseek用于得到文件位置指针当前位置相对于文件首的偏移字节数
    fileSize = ftell(pFile);
    fseek(pFile,0L,SEEK_SET);
    //分配缓冲区 pFileBuffer缓冲区的
    pFileBuffer = malloc(fileSize);
    if(!pFileBuffer)
    {
   
        printf("分配文件失败！");
        fclose(pFil