滴水三期PE文件格式个人笔记

#define _CRT_SECURE_NO_WARNINGS
#include "main.h"

int main(int argc, char* argv[]) {
   
	printf("please input a file to local direct,and press any key continue\n");
	char filename[20] = {
    0 };
	DWORD dwSize = scanf("%s", filename);
	PVOID buf = NULL;
	dwSize = file2buf(filename, &buf);
	if (dwSize == 0)
	{
   
		printf("Open File Failed,Exiting Now...\n");
		return 0;
	}

	while (TRUE)
	{
   
		UINT32 caseNum = 0;
		//printf("Select a Options\n");
		printf("\n1:print NT_Header\n");
		printf("2:Print Export Direction\n");
		printf("3:Print Import Direction\n");
		printf("4:Print Reloc Direction\n");
		printf("5:Rva To Ptr\n");
		printf("6:Add Section to File\n");
		printf("7:Merge All Section\n");
		printf("8:buff to New File:\n");
		printf("88:Exit Application\n");
		printf("\nSelect: ");
		scanf("%d", &caseNum);
		switch (caseNum)
		{
   
		case 1:
			PrintNTHeaders(&buf);
		case 2:
			PrintExport(&buf);
			break;
		case 3:
			PrintImport(&buf);
			break;
		case 4:
			PrintReloc(&buf);
			break;
		case 5:
			break;
		case 6:
		{
   
			BYTE newsecname[8] = {
    0 };
			DWORD dwNewSecsize = 0;
			printf("Input New Section Name,Length must be less than 8:");
			int inputsize = scanf("%s", newsecname);
			if (inputsize == 0) {
   
				printf("Input Error,Exiting...\n");
				goto loop;
			}
			printf("Input New Section Size:");
			inputsize = scanf("%d", &dwNewSecsize);
			if (inputsize == 0) {
   
				printf("Input Error,Exiting...\n");
				goto loop;
			}
			buf = Addsec(&buf, dwNewSecsize, newsecname);
			break;
		}
		case 7:
			break;
		case 8:
		{
   
			char szNewfilename[20] = {
    0 };
			printf("Input New File Name:");
			scanf("%s", szNewfilename);
			buf2file(&buf, szNewfilename);
		}
		case 88:
			goto loop;
			break;
		default:
			break;
		}
	}
loop:
	if (buf != NULL) {
   
		free(buf);
	}
	return 0;
}

int file2buf(char* pfname, PVOID* outbuf) {
   
	FILE* pf = fopen(pfname, "rb");
	if (pf == NULL) {
   
		perror("fopen");
		return 0;
	}
	fseek(pf, 0, SEEK_END);
	int len = ftell(pf);
	//计算文件大小
	rewind(pf);
	//指针回位
	if (len == 0) {
   
		printf("获取文件大小失败！");
		return 0;
	}
	rewind(pf);
	*outbuf = malloc(len);
	memset(*outbuf, 0, len);
	fread(*outbuf, sizeof(char), len, pf);
	DWORD dossn = *(DWORD*)*outbuf;
	if (dossn == 0x905a4d) {
   
		return len;
	}
	else
		return 0;
}

LPCSTR addcodetocd(PVOID* FileBuf, PVOID pCode, UINT32 nCodesize) {
   
	PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)*FileBuf;
	PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew);
	PIMAGE_FILE_HEADER pPEHeader = (PIMAGE_FILE_HEADER)((DWORD)pDosHeader + pDosHeader->e_lfanew + 4);
	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + sizeof(IMAGE_FILE_HEADER));
	PIMAGE_SECTION_HEADER pSectionHeader = \
		(PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader + pPEHeader->SizeOfOptionalHeader);
	int nFlags = -1;
	for (int i = 0; i < pPEHeader->NumberOfSections; i++)
	{
   
		//if ((pSectionHeader+i)->PointerToRawData + (pSectionHeader+i) + nCodesize < (pSectionHeader+i+1)->PointerToRawData) {
   
		int n = 0;
		for (UINT32 j = 1; j <= nCodesize; j++)
		{
   
			if (*(PBYTE)((DWORD)pDosHeader + (pSectionHeader + i + 1)->PointerToRawData - j) != 0)
				break;
			else
				n++;
		}
		if (n == nCodesize) {
   
			nFlags = i;
			break;
		}
	}
	if (nFlags == -1) {
   
		printf("没有足够空间添加代码");
		return 0;
	}
	memcpy((PBYTE)((DWORD)pDosHeader + (pSectionHeader + nFlags + 1)->PointerToRawData - nCodesize), pCode, nCodesize);
	printf("已插入数据在：%s", (pSectionHeader + nFlags)->Name);
	return (pSectionHeader + nFlags)->Name;
}

PVOID buf2image(PVOID* buf) {
   
	BYTE* pbuf = (BYTE*)*buf;
	printf("PE头地址：0x%x\n", *(int*)(pbuf + 0x3c));
	int e_lfanew = *(int*)(pbuf + 0x3c);
	PIMAGE_FILE_HEADER pFileHeader = (PIMAGE_FILE_HEADER)(pbuf + e_lfanew + 0x4);
	PIMAGE_OPTIONAL_HEADER pOptionalHeader = (PIMAGE_OPTIONAL_HEADER)(pbuf + e_lfanew + 0x18);
	UINT sizeopt = pFileHeader->SizeOfOptionalHeader;
	ULONG headersize = pOptionalHeader->SizeOfHeaders;
	ULONG sizeofima = pOptionalHeader->SizeOfImage;
	PVOID newbuf = malloc(sizeofima);
	memset(newbuf, 0, sizeofima);
	newbuf = memcpy(newbuf, *buf, headersize);
	PIMAGE_SECTION_HEADER sectionList = (PIMAGE_SECTION_HEADER)(pbuf + e_lfanew + sizeopt + 0x18);
	int numofsec = pFileHeader