1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

DWORD RvaToFoa(IN LPVOID pFileBuffer, IN DWORD dwRva) {
    if (pFileBuffer == NULL) {
        return 0;
    }
    PIMAGE_DOS_HEADER pDos = NULL;
    PIMAGE_NT_HEADERS pNT = NULL;
    PIMAGE_FILE_HEADER pPE = NULL;
    PIMAGE_SECTION_HEADER pSec = NULL;
    pDos = (PIMAGE_DOS_HEADER)pFileBuffer;
    if (pDos->e_magic != IMAGE_DOS_SIGNATURE) {
        return 0;
    }
    pNT = (PIMAGE_NT_HEADERS)((BYTE*)pFileBuffer + pDos->e_lfanew);
    if (pNT->Signature != IMAGE_NT_SIGNATURE) {
        return 0;
    }
    if (dwRva < pNT->OptionalHeader.SizeOfHeaders) {
        return dwRva;
    }
    pPE = &pNT->FileHeader;
    if (pNT->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64) {
    	PIMAGE_OPTIONAL_HEADER64 pOpt = (PIMAGE_OPTIONAL_HEADER64)&pNT->OptionalHeader;
    	pSec = (PIMAGE_SECTION_HEADER)((BYTE*)pOpt + pPE->SizeOfOptionalHeader);
	} else {
    	PIMAGE_OPTIONAL_HEADER32 pOpt = (PIMAGE_OPTIONAL_HEADER32)&pNT->OptionalHeader;
    	pSec = (PIMAGE_SECTION_HEADER)((BYTE*)pOpt + pPE->SizeOfOptionalHeader);
	}
    WORD numSec = pPE->NumberOfSections;
    for (WORD i = 0; i < numSec; i++) {
        DWORD dwVA = pSec->VirtualAddress;	//其中dwVA也是该节的RVA
        DWORD dwVS = pSec->Misc.VirtualSize;
        if (dwRva >= dwVA && dwRva < (dwVA + dwVS)) {
            // 公式：FOA = RVA - 节区虚拟地址 + 节区文件偏移
            DWORD dwFoa = (dwRva - dwVA) + pSec->PointerToRawData;
            return dwFoa;
        }
        pSec++;
    }
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

1	DOS头													//滴水				//我自己
typedef struct _IMAGE_DOS_HEADER {
	WORD e_magic; *		//Magic number(MZ);					//5A4D
	WORD e_cblp;		//Bytes on last page of file		//0090
	WORD e_cp;			//Pages in file						//0003
	WORD e_crlc;		//Relocations						//0000
	WORD e_cparhdr;		//Size of header in paragraphs		//0004
	WORD e_minalloc;	//Minimum extra paragraphs needed	//0000
	WORD e_maxalloc;	//Maximum extra paragraphs needed	//FFFF
	WORD e_ss;			//Initial (relative) SS value		//0000
	WORD e_sp;			//Initial SP value					//00B8
	WORD e_csum;		//Checksum							//0000
	WORD e_ip;			//Initial IP value					//0000
	WORD e_cs;			//Initial (relative) CS value		//0000
	WORD e_lfarlc;		//File address of relocation table	//0040
	WORD e_ovno;		//Overlay number					//0000
	WORD e_res[4];		//Reserved words		//0000 0000 0000 0000
	WORD e_oemid;		//OEM identifier (for e_oeminfo)	//0000
	WORD e_oeminfo;		//OEM information; e_oemid specific	//0000
	WORD e_res2[10];	//Reserved words	//0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
	DWORD e_lfanew; *	//File address of new exe header 	//0000 00E8	->	//0000 0108
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

1
2
3
4
5

typedef struct _IMAGE_NT_HEADERS {
    DWORD Signature;                         //NT头标志 即'PE..' 00004550
    IMAGE_FILE_HEADER FileHeader;            //标准PE头
    IMAGE_OPTIONAL_HEADER32 OptionalHeader;  //扩展PE头
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

2	标准PE头
typedef struct _IMAGE_FILE_HEADER {
    WORD    Machine; *                    //程序运行的CPU型号 x86CPU:0x14C x64CPU:0x8864
    WORD    NumberOfSections; *           //PE中节的数量
    DWORD   TimeDateStamp; *              //时间戳：文件创建的日期和时间
    DWORD   PointerToSymbolTable;         //执行符号表，即编译好的程序生成的pdb文件，用来方便调试的
    DWORD   NumberOfSymbols;              //符号表中的符号数量
    WORD    SizeOfOptionalHeader; *       //可选PE头的大小 x86（32位）:224字节 x64（64位）:240字节
    WORD    Characteristics; *            //文件属性，每个位有不同的含义 x86:0x3 x64:0x22
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

3	可选PE头
typedef struct _IMAGE_OPTIONAL_HEADER {
    WORD    Magic; *                      //魔数 x86:0x10B x64:0x20B
    BYTE    MajorLinkerVersion;           //链接器的版本
    BYTE    MinorLinkerVersion;           //连接器的版本
    DWORD   SizeOfCode; *                 //所有代码区段的大小总和，必须是FileAlignment的整数倍
    DWORD   SizeOfInitializedData; *      //已经初始化数据区段大小总和，必须是FileAlignment的整数倍
    DWORD   SizeOfUninitializedData; *    //未初始化数据区段大小总和，必须是FileAlignment的整数倍
    DWORD   AddressOfEntryPoint; **       //程序入口OEP+ImageBase
    DWORD   BaseOfCode; *                 //代码段的起始RVA
    DWORD   BaseOfData; *                 //数据段的起始RVA（32+PE删除了）
    DWORD   ImageBase; **                 //程序建议的加载地址（内存镜像基地址） x64 ULONGLONG
    DWORD   SectionAlignment; **          //内存中的对齐粒度 x86 0x1000 x64 0x2000
    DWORD   FileAlignment; **             //文件中的对齐粒度 0x200
    WORD    MajorOperatingSystemVersion;  //操作系统版本号
    WORD    MinorOperatingSystemVersi on;
    WORD    MajorImageVersion;            //PE的镜像备案本号
    WORD    MinorImageVersion;
    WORD    MajorSubsystemVersion;        //子系统的版本号。
    WORD    MinorSubsystemVersion;
    DWORD   Win32VersionValue;            //Win32版本（未使用）
    DWORD   SizeOfImage; **               //内存中整个PE镜像的尺寸，必须是SectionAlignment的整数倍
    DWORD   SizeOfHeaders; **             //所有头+节表按照文件对齐后的大小
    DWORD   CheckSum; *                   //校验和
    WORD    Subsystem;                    //子系统，其决定了程序入口点main函数的不同，常见的子系统有窗口，控制台等等
    WORD    DllCharacteristics;           //DLL动态链接库特性
    DWORD   SizeOfStackReserve; *         //初始化时的栈大小
    DWORD   SizeOfStackCommit; *          //初始化时实际上提交的栈大小
    DWORD   SizeOfHeapReserve; *          //初始化时保留的堆大小
    DWORD   SizeOfHeapCommit; *           //初始化时实际上提交的堆大小
    DWORD   LoaderFlags;                  //加载标记
    DWORD   NumberOfRvaAndSizes; *        //数据目录结构的数量
    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; //数据目录表数组
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

1
2
3
4
5
6
7
8

DWORD   AddressOfEntryPoint; **       //程序入口OEP+ImageBase
DWORD   ImageBase; **                 //程序建议的加载地址（内存镜像基地址）
DWORD   SectionAlignment; **          //内存中的对齐粒度 x86 0x1000 x64 0x2000
DWORD   FileAlignment; **             //文件中的对齐粒度 0x200
DWORD   SizeOfImage; **               //内存中整个PE文件的映像（镜像）的尺寸，必须是SectionAlignment的整数倍
DWORD   SizeOfHeaders; **             //所有头+节表按照文件对齐后的大小
DWORD   NumberOfRvaAndSizes; *        //数据目录结构的数量
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; //数据目录表数组（16*8字节）

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

#define IMAGE_SIZEOF_SHORT_NAME 8 			//宏定义 
typedef struct _IMAGE_SECTION_HEADER{
    BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; *	//每一个节都可以取一个名字，最大长度为8字节
    union{									//联合体（大小为最大属性的大小）
        DWORD   PhysicalAddress;
        DWORD   VirtualSize;
    } Misc; *								//是该节在没有对齐前的真实尺寸（若被修改则不准确）
    DWORD VirtualAddress; *					//节在内存中的偏移地址（相对偏移）
    DWORD SizeOfRawData; *					//节在文件中对齐后的尺寸
    DWORD PointerToRawData; *				//节在文件中的偏移
    DWORD PointerToRelocations;
    DWORD PointerToLinenumbers;
    WORD NumberOfRelocations;
    WORD NumberOfLinenumbers;
    DWORD Characteristics; *				//节的属性
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

1

int MessageBox( HWND hWnd,LPCTSTR lpText, LPCTSTR lpCaption = NULL, UINT nType = MB_OK );

1
2
3
4
5

#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
typedef struct _IMAGE_DATA_DIRECTORY {
    DWORD VirtualAddress;	//内存偏移
    DWORD Size;				//大小
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

#define IMAGE_DIRECTORY_ENTRY_EXPORT          0   // Export Directory  导出表:动态链接库导出的函数会显示在这里
#define IMAGE_DIRECTORY_ENTRY_IMPORT          1   // Import Directory  导入表:写程序时调用的动态链接库会显示在这里
#define IMAGE_DIRECTORY_ENTRY_RESOURCE        2   // Resource Directory  资源表:图片,图标,字符串,嵌入的程序都在这里
#define IMAGE_DIRECTORY_ENTRY_EXCEPTION       3   // Exception Directory  异常目录表:保存文件中异常处理相关的数据
#define IMAGE_DIRECTORY_ENTRY_SECURITY        4   // Security Directory  安全目录:存放数字签名和安全证书之类的东西
#define IMAGE_DIRECTORY_ENTRY_BASERELOC       5   // Base Relocation Table  基础重定位表:保存需要执行重定位的代码偏移
#define IMAGE_DIRECTORY_ENTRY_DEBUG           6   // Debug Directory  调试表
#define IMAGE_DIRECTORY_ENTRY_COPYRIGHT       7   // (X86 usage)
#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE    7   // Architecture Specific Data  缓存信息表:有一些保留字段必须是0
#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR       8   // RVA of GP  全局指针偏移目录
#define IMAGE_DIRECTORY_ENTRY_TLS             9   // TLS Directory  线程局部存储(暂时未知)
#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    10   // Load Configuration Directory  载入配置
#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   11   // Bound Import Directory in headers 存储一些API的绑定输入信息
#define IMAGE_DIRECTORY_ENTRY_IAT            12   // Import Address Table 导入地址表：导入函数的地址
#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   13   // Delay Load Import Descriptors
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14   // COM Runtime descriptor com运行时的目录
//最后一个保留

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

typedef struct _IMAGE_EXPORT_DIRECTORY {
    DWORD   Characteristics;
    DWORD   TimeDateStamp;  		//时间戳
    WORD    MajorVersion;
    WORD    MinorVersion;
    DWORD   Name;   				//指向导出表文件名字符串
    DWORD   Base;   				//导出函数起始序号
    DWORD   NumberOfFunctions;  	//所有导出函数的个数（导出函数最大序号 - 起始序号 + 1）
    DWORD   NumberOfNames;  		//以函数名字导出的函数的个数（即有函数名的函数个数）
    DWORD   AddressOfFunctions;     //导出函数地址表的RVA
    DWORD   AddressOfNames;         //导出函数名称表的RVA
    DWORD   AddressOfNameOrdinals;  //导出函数序号表的RVA
} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;

1
2
3
4
5
6

typedef struct _IMAGE_BASE_RELOCATION {
    DWORD   VirtualAddress;		//RVA
    DWORD   SizeOfBlock;		//重定位块大小
    //WORD    TypeOffset[1];	//虽然被注释，但仍存在，其16位大小，前四位为Type，后十二位为Offest
} IMAGE_BASE_RELOCATION;
typedef IMAGE_BASE_RELOCATION UNALIGNED * PIMAGE_BASE_RELOCATION;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

VOID DisplayRelocTable(){
	DWORD dwSize = 0;
	DWORD dwFOA = 0;
	DWORD dwSizeOfDirectory = 0;
	LPVOID pFileBuffer = NULL;
	PWORD pRelocData = NULL;
	PIMAGE_DOS_HEADER pDosHeader = NULL; 
	PIMAGE_NT_HEADERS pNTHeader = NULL;
	PIMAGE_FILE_HEADER pPEHeader = NULL;
	PIMAGE_DATA_DIRECTORY pDataDirectory = NULL;
    PIMAGE_BASE_RELOCATION pRelocTable = NULL;
	dwSize = ReadPEFile(path, &pFileBuffer);
	if(dwSize == 0 || !pFileBuffer){
		printf("Fail to read file\n");
		return ;
	}
	if(!isPE(pFileBuffer)){
		printf("Is not PE file!\n");
		return ;
	}
	pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
	pNTHeader = (PIMAGE_NT_HEADERS)((BYTE*)pFileBuffer + pDosHeader->e_lfanew);
	pPEHeader = &pNTHeader->FileHeader;
	if (pNTHeader->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64) {
    	PIMAGE_OPTIONAL_HEADER64 pOptionHeader = (PIMAGE_OPTIONAL_HEADER64)&pNTHeader->OptionalHeader;
    	dwSizeOfDirectory = pOptionHeader->NumberOfRvaAndSizes;
		pDataDirectory = pOptionHeader->DataDirectory;
	} else {
    	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)&pNTHeader->OptionalHeader;
    	dwSizeOfDirectory = pOptionHeader->NumberOfRvaAndSizes;
		pDataDirectory = pOptionHeader->DataDirectory;
	}
	dwFOA = RvaToFoa(pFileBuffer, pDataDirectory[5].VirtualAddress);	//定位重定位表
	pRelocTable = (PIMAGE_BASE_RELOCATION)((BYTE*)pFileBuffer + dwFOA);
	printf("***************BaseRelocation***************\n");
	int i=1;
	while (pRelocTable->VirtualAddress != 0 && pRelocTable->SizeOfBlock != 0){	//遍历重定位表
		printf("RelocTable[%d]\tRVA:%0X, Size:%0X\n", i, pRelocTable->VirtualAddress, pRelocTable->SizeOfBlock);
		DWORD dwItems = ((pRelocTable->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / 2);
		printf("项目数:%X h / %d d\r\n", dwItems, dwItems);
		pRelocData = (PWORD)((BYTE*)pRelocTable + 0x8);
		for (int i = 0; i < dwItems; i++ ){
			if (*(pRelocData + i) >> 12 == IMAGE_REL_BASED_HIGHLOW){	//IMAGE_REL_BASED_HIGHLOW = 3
				DWORD dwRva = ((*(pRelocData + i) & 0x0fff) + pRelocTable->VirtualAddress);
				DWORD dwFoa = RvaToFoa(pFileBuffer, dwRva);
				DWORD dwFarCall = *(DWORD*)(pFileBuffer + dwFoa);
				printf("RVA:0x%X\tFOA:0x%X\tFarCall:0x%X\t(HIGHLOW)\n", dwRva, dwFoa, dwFarCall);	//需要重定位的函数
			}else{
				printf("-(ABSLUTE)\r\n");	//类型非3的提示
			}
		}
		pRelocTable = (PIMAGE_BASE_RELOCATION)((BYTE*)pRelocTable + pRelocTable->SizeOfBlock);
		i++;
	}
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107

// 移动导出表函数
BOOL MoveExportTable(LPVOID* ppFileBuffer, DWORD* pFileSize) {
    IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)*ppFileBuffer;
    IMAGE_NT_HEADERS* pNtHeaders = (IMAGE_NT_HEADERS*)((BYTE*)*ppFileBuffer + pDosHeader->e_lfanew);
    
    // 获取导出表目录项
    IMAGE_DATA_DIRECTORY* exportDir = &pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
    if (exportDir->VirtualAddress == 0 || exportDir->Size == 0) {
        printf("No export table found\n");
        return FALSE;
    }
    
    // 获取导出表结构
    DWORD exportFoa = RvaToFoa(*ppFileBuffer, exportDir->VirtualAddress);
    IMAGE_EXPORT_DIRECTORY* pExportDir = (IMAGE_EXPORT_DIRECTORY*)((BYTE*)*ppFileBuffer + exportFoa);
    
    // 获取DLL名称
    DWORD dllNameFoa = RvaToFoa(*ppFileBuffer, pExportDir->Name);
    char* dllName = (char*)((BYTE*)*ppFileBuffer + dllNameFoa);
    DWORD dllNameLen = strlen(dllName) + 1; // 包括null终止符
    
    // 计算导出表总大小
    DWORD totalSize = sizeof(IMAGE_EXPORT_DIRECTORY);
    totalSize += pExportDir->NumberOfFunctions * sizeof(DWORD);  // AddressOfFunctions
    totalSize += pExportDir->NumberOfNames * sizeof(DWORD);      // AddressOfNames
    totalSize += pExportDir->NumberOfNames * sizeof(WORD);       // AddressOfNameOrdinals
    
    // 计算函数名字符串总长度
    DWORD* nameRVAs = (DWORD*)((BYTE*)*ppFileBuffer + RvaToFoa(*ppFileBuffer, pExportDir->AddressOfNames));
    for (DWORD i = 0; i < pExportDir->NumberOfNames; i++) {
        DWORD nameFoa = RvaToFoa(*ppFileBuffer, nameRVAs[i]);
        totalSize += strlen((char*)*ppFileBuffer + nameFoa) + 1; // 字符串+null终止符
    }
    
    // 添加DLL名称长度
    totalSize += dllNameLen;
    
    // 添加新节
    DWORD newSectionFoa = AddNewSection(ppFileBuffer, pFileSize, ".edata", totalSize, 
                                       IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ);
    if (!newSectionFoa) {
        printf("Failed to add new section for export table\n");
        return FALSE;
    }
    
    // 获取新节RVA
    DWORD newSectionRva = FoaToRva(*ppFileBuffer, newSectionFoa);
    
    // 准备复制指针
    BYTE* newSectionStart = (BYTE*)*ppFileBuffer + newSectionFoa;
    BYTE* currentPos = newSectionStart;
    
    // 1. 复制AddressOfFunctions数组
    DWORD* srcFunctions = (DWORD*)((BYTE*)*ppFileBuffer + RvaToFoa(*ppFileBuffer, pExportDir->AddressOfFunctions));
    DWORD* destFunctions = (DWORD*)currentPos;
    memcpy(destFunctions, srcFunctions, pExportDir->NumberOfFunctions * sizeof(DWORD));
    DWORD newFunctionsRva = newSectionRva + (DWORD)((BYTE*)destFunctions - newSectionStart);
    currentPos += pExportDir->NumberOfFunctions * sizeof(DWORD);
    
    // 2. 复制AddressOfNameOrdinals数组
    WORD* srcOrdinals = (WORD*)((BYTE*)*ppFileBuffer + RvaToFoa(*ppFileBuffer, pExportDir->AddressOfNameOrdinals));
    WORD* destOrdinals = (WORD*)currentPos;
    memcpy(destOrdinals, srcOrdinals, pExportDir->NumberOfNames * sizeof(WORD));
    DWORD newOrdinalsRva = newSectionRva + (DWORD)((BYTE*)destOrdinals - newSectionStart);
    currentPos += pExportDir->NumberOfNames * sizeof(WORD);
    
    // 3. 复制AddressOfNames数组和函数名字符串
    DWORD* srcNames = (DWORD*)((BYTE*)*ppFileBuffer + RvaToFoa(*ppFileBuffer, pExportDir->AddressOfNames));
    DWORD* destNames = (DWORD*)currentPos;
    currentPos += pExportDir->NumberOfNames * sizeof(DWORD);
    
    for (DWORD i = 0; i < pExportDir->NumberOfNames; i++) {
        // 复制字符串
        DWORD nameFoa = RvaToFoa(*ppFileBuffer, srcNames[i]);
        char* srcName = (char*)*ppFileBuffer + nameFoa;
        char* destName = (char*)currentPos;
        DWORD nameLen = strlen(srcName) + 1;
        memcpy(destName, srcName, nameLen);
        
        // 更新AddressOfNames数组
        destNames[i] = newSectionRva + (DWORD)(currentPos - newSectionStart);
        currentPos += nameLen;
    }
    DWORD newNamesRva = newSectionRva + (DWORD)((BYTE*)destNames - newSectionStart);
    
    // 4. 复制DLL名称字符串
    char* newDllName = (char*)currentPos;
    memcpy(newDllName, dllName, dllNameLen);
    DWORD newDllNameRva = newSectionRva + (DWORD)(currentPos - newSectionStart);
    currentPos += dllNameLen;
    
    // 5. 复制IMAGE_EXPORT_DIRECTORY结构
    IMAGE_EXPORT_DIRECTORY* destExportDir = (IMAGE_EXPORT_DIRECTORY*)currentPos;
    memcpy(destExportDir, pExportDir, sizeof(IMAGE_EXPORT_DIRECTORY));
    
    // 修复导出表指针
    destExportDir->AddressOfFunctions = newFunctionsRva;
    destExportDir->AddressOfNames = newNamesRva;
    destExportDir->AddressOfNameOrdinals = newOrdinalsRva;
    destExportDir->Name = newDllNameRva; // 更新DLL名称的RVA
    
    // 6. 更新数据目录
    DWORD newExportDirRva = newSectionRva + (DWORD)(currentPos - newSectionStart);
    pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress = newExportDirRva;
    
    return TRUE;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

// 移动重定位表函数
BOOL MoveRelocationTable(LPVOID* ppFileBuffer, DWORD* pFileSize) {
    IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)*ppFileBuffer;
    IMAGE_NT_HEADERS* pNTHeader = (IMAGE_NT_HEADERS*)((BYTE*)*ppFileBuffer + pDosHeader->e_lfanew);
    PIMAGE_DATA_DIRECTORY pDataDirectory = NULL;
    if (pNTHeader->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64) {
        PIMAGE_OPTIONAL_HEADER64 pOptionHeader = (PIMAGE_OPTIONAL_HEADER64)&pNTHeader->OptionalHeader;
        pDataDirectory = pOptionHeader->DataDirectory;
    } else {
        PIMAGE_OPTIONAL_HEADER32 pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)&pNTHeader->OptionalHeader;
        pDataDirectory = pOptionHeader->DataDirectory;
    }
    // 获取导出表目录项
    IMAGE_DATA_DIRECTORY* relocDir = &pDataDirectory[5];
    if (relocDir->VirtualAddress == 0 || relocDir->Size == 0) {
        printf("No relocation table found, %xh--%xh\n", relocDir->VirtualAddress, relocDir->Size);
        return FALSE;
    }
    
    // 添加新节
    DWORD newSectionFoa = AddNewSection(ppFileBuffer, pFileSize, ".reloc", relocDir->Size, 
                                       IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ);
    if (!newSectionFoa) {
        printf("Failed to add new section for relocation table\n");
        return FALSE;
    }
    
    // 获取重定位表FOA
    DWORD relocFoa = RvaToFoa(*ppFileBuffer, relocDir->VirtualAddress);
    
    // 复制重定位表数据
    memcpy((BYTE*)*ppFileBuffer + newSectionFoa, 
           (BYTE*)*ppFileBuffer + relocFoa, 
           relocDir->Size);
    
    // 更新数据目录
    DWORD newRelocRva = FoaToRva(*ppFileBuffer, newSectionFoa);
    relocDir->VirtualAddress = newRelocRva;
    
    return TRUE;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

// 修改ImageBase并应用重定位修正
BOOL RebasePE(LPVOID pFileBuffer, DWORD newImageBase) {
    IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)pFileBuffer;
    IMAGE_NT_HEADERS* pNtHeaders = (IMAGE_NT_HEADERS*)((BYTE*)pFileBuffer + pDosHeader->e_lfanew);
    PIMAGE_DATA_DIRECTORY pDataDirectory = NULL;
    DWORD oldImageBase = 0;
    if (pNtHeaders->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64) {
        PIMAGE_OPTIONAL_HEADER64 pOptionHeader = (PIMAGE_OPTIONAL_HEADER64)&pNtHeaders->OptionalHeader;
        oldImageBase = pOptionHeader->ImageBase;
        pOptionHeader->ImageBase = newImageBase;    // 更新ImageBase
        pDataDirectory = pOptionHeader->DataDirectory;
    } else {
        PIMAGE_OPTIONAL_HEADER32 pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)&pNtHeaders->OptionalHeader;
        oldImageBase = pOptionHeader->ImageBase;
        pOptionHeader->ImageBase = newImageBase;
        pDataDirectory = pOptionHeader->DataDirectory;
    }
    // 如果新旧基址相同，不需要重定位
    if (oldImageBase == newImageBase) {
        printf("ImageBase unchanged (0x%08X), no rebasing needed\n", newImageBase);
        return TRUE;
    }
    printf("ImageBase changed from 0x%08X to 0x%08X\n", oldImageBase, newImageBase);
    
    // 获取重定位表
    IMAGE_DATA_DIRECTORY* relocDir = &pDataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];
    if (relocDir->VirtualAddress == 0 || relocDir->Size == 0) {
        printf("No relocation table found, skipping rebasing\n");
        return TRUE;
    }
    
    // 计算基址差值
    DWORD_PTR delta = (DWORD_PTR)newImageBase - (DWORD_PTR)oldImageBase;
    
    // 获取重定位表起始位置
    DWORD relocFoa = RvaToFoa(pFileBuffer, relocDir->VirtualAddress);
    IMAGE_BASE_RELOCATION* pRelocTable = (IMAGE_BASE_RELOCATION*)((BYTE*)pFileBuffer + relocFoa);
    
    // 遍历重定位块
    int i=1;
    while (pRelocTable->VirtualAddress != 0 && pRelocTable->SizeOfBlock != 0){  //遍历重定位表
        DWORD dwItems = ((pRelocTable->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / 2);
        PWORD pRelocData = (PWORD)((BYTE*)pRelocTable + 0x8);
        for (int i = 0; i < dwItems; i++ ){
            if (*(pRelocData + i) >> 12 == IMAGE_REL_BASED_HIGHLOW){    //IMAGE_REL_BASED_HIGHLOW = 3
                DWORD dwRva = ((*(pRelocData + i) & 0x0fff) + pRelocTable->VirtualAddress);
                DWORD dwFoa = RvaToFoa(pFileBuffer, dwRva);
                DWORD* pFuncall = (DWORD*)(pFileBuffer + dwFoa);
                *pFuncall += delta; //重定位
            }
        }
        pRelocTable = (PIMAGE_BASE_RELOCATION)((BYTE*)pRelocTable + pRelocTable->SizeOfBlock);
        i++;
    }
    return TRUE;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

typedef struct _IMAGE_IMPORT_DESCRIPTOR {
    union {
        DWORD   Characteristics;
        DWORD   OriginalFirstThunk; *	// 包含指向IMAGE_THUNK_DATA(导入名称表INT)结构数组的RVA
    } DUMMYUNIONNAME;
    DWORD   TimeDateStamp;              // 时间戳：当可执行文件不与被输入的DLL进行绑定时，此字段为0 若绑定，则为-1（0xffffffff）
    DWORD   ForwarderChain;             // 第一个被转向的API的索引
    DWORD   Name;                       // 指向被输入的DLL的ASCII字符串的RVA
    DWORD   FirstThunk; *               // 指向导入地址表(IAT)的RVA
} IMAGE_IMPORT_DESCRIPTOR;
typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED * IMAGE_IMPORT_DESCRIPTOR;

1
2
3
4
5
6
7
8
9

typedef struct _IMAGE_THUNK_DATA32 {
    union {
        DWORD ForwarderString;		// PBYTE 
        DWORD Function;				// PDWORD
        DWORD Ordinal;				// 导出序号
        PIMAGE_IMPORT_BY_NAME AddressOfData;        // 指向IMAGE_IMPORT_BY_NAME的RVA（指针都是4字节）
    } u1;
} IMAGE_THUNK_DATA32;
typedef IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32;

1
2
3
4

typedef struct _IMAGE_IMPORT_BY_NAME {
    WORD    Hint;		// 函数序号
    CHAR   Name[];		// 导入函数的名称（指针4字节）
} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

VOID DisplayImportTable(){
	DWORD dwSize = 0;
	DWORD dwFOA = 0;
	DWORD dwSizeOfDirectory = 0;
	LPVOID pFileBuffer = NULL;
	PWORD pRelocData = NULL;
	PIMAGE_DOS_HEADER pDosHeader = NULL; 
	PIMAGE_NT_HEADERS pNTHeader = NULL;
	PIMAGE_FILE_HEADER pPEHeader = NULL;
	PIMAGE_DATA_DIRECTORY pDataDirectory = NULL;
	PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor = NULL;
	dwSize = ReadPEFile(path, &pFileBuffer);
	if(dwSize == 0 || !pFileBuffer){
		printf("Fail to read file\n");
		return ;
	}
	if(!isPE(pFileBuffer)){
		printf("Is not PE file!\n");
		return ;
	}
	pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
	pNTHeader = (PIMAGE_NT_HEADERS)((BYTE*)pFileBuffer + pDosHeader->e_lfanew);
	pPEHeader = &pNTHeader->FileHeader;
	if (pNTHeader->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64) {
    	PIMAGE_OPTIONAL_HEADER64 pOptionHeader = (PIMAGE_OPTIONAL_HEADER64)&pNTHeader->OptionalHeader;
    	dwSizeOfDirectory = pOptionHeader->NumberOfRvaAndSizes;
		pDataDirectory = pOptionHeader->DataDirectory;
	} else {
    	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)&pNTHeader->OptionalHeader;
    	dwSizeOfDirectory = pOptionHeader->NumberOfRvaAndSizes;
		pDataDirectory = pOptionHeader->DataDirectory;
	}
	dwFOA = RvaToFoa(pFileBuffer, pDataDirectory[1].VirtualAddress);	//定位导入表
	pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((BYTE*)pFileBuffer + dwFOA);
	printf("***************ImportDescriptor***************\n");
	while(!(pImportDescriptor->FirstThunk == 0 && pImportDescriptor->OriginalFirstThunk == 0)){	//遍历导入表
		printf("***%s***\n", (PBYTE)((BYTE*)pFileBuffer + RvaToFoa(pFileBuffer, pImportDescriptor->Name)));
		printf("-------OriginalFirstThunk-------\n");
		PDWORD pOriginalFirstThunk = (PDWORD)((BYTE*)pFileBuffer + RvaToFoa(pFileBuffer, pImportDescriptor->OriginalFirstThunk));
		printf("%x - %x\n", pOriginalFirstThunk, *pOriginalFirstThunk);
		printf("TimeDateStamp: %x\n", pImportDescriptor->TimeDateStamp);
		while(*pOriginalFirstThunk){	//遍历INT表
			if(*pOriginalFirstThunk & IMAGE_ORDINAL_FLAG32){	//IMAGE_ORDINAL_FLAG32 = 0x80000000
				printf("按序号导入：%x\n", (*pOriginalFirstThunk)&0x0FFFF);
			}else{
				PIMAGE_IMPORT_BY_NAME pImageByName = (PIMAGE_IMPORT_BY_NAME)((BYTE*)pFileBuffer + RvaToFoa(pFileBuffer, *pOriginalFirstThunk));
				printf("按名称导入Hint-Name: %x-%s\n", pImageByName->Hint, pImageByName->Name);
			}
			//pOriginalFirstThunk = (PDWORD)((BYTE*)pOriginalFirstThunk + sizeof(IMAGE_THUNK_DATA32));
			pOriginalFirstThunk++;
		}
		printf("-------FirstThunk-------\n");
		PDWORD pFirstThunk = (PDWORD)((BYTE*)pFileBuffer + RvaToFoa(pFileBuffer, pImportDescriptor->FirstThunk));
		printf("%x - %x\n", pFirstThunk, *pFirstThunk);
		while(*pFirstThunk){
			if(*pFirstThunk & IMAGE_ORDINAL_FLAG32){	//IMAGE_ORDINAL_FLAG32 = 0x80000000
				printf("按序号导入：%x\n", (*pFirstThunk)&0x0FFFF);
			}else{
				PIMAGE_IMPORT_BY_NAME pImageByName = (PIMAGE_IMPORT_BY_NAME)((BYTE*)pFileBuffer + RvaToFoa(pFileBuffer, *pFirstThunk));
				printf("按名称导入Hint-Name: %x-%s\n", pImageByName->Hint, pImageByName->Name);
			}
			//pFirstThunk = (PDWORD)((BYTE*)pFirstThunk + sizeof(IMAGE_THUNK_DATA32));
			pFirstThunk++;
		}
		pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((BYTE*)pImportDescriptor + sizeof(IMAGE_IMPORT_DESCRIPTOR));
	}
	free(pFileBuffer);
}

1
2
3
4
5

struct _IMAGE_BOUND_IMPORT_DESCRIPTOR{						
    DWORD TimeDateStamp;	//时间戳					
    WORD OffsetModuleName;	//DLL的名字RVA（加第一个结构中RVA才是字符串真正RVA，详见下面）	
    WORD NumberOfModuleForwarderRefs;  //这个绑定导入表结构后面还有几个_IMAGE_BOUND_FORWARDER_REF这种结构					
} IMAGE_BOUND_IMPORT_DESCRIPTOR, *PIMAGE_BOUND_IMPORT_DESCRIPTOR;  //绑定导入表有很多这种结构或者_IMAGE_BOUND_FORWARDER_REF这种结构，最后如果有sizeof(_IMAGE_BOUND_IMPORT_DESCRIPTOR)个0，表示绑定导入表结束	

1
2
3
4
5

struct _IMAGE_BOUND_FORWARDER_REF {			
    DWORD TimeDateStamp;	//时间戳		
    WORD OffsetModuleName;  //对应DLL的名字
    WORD Reserved;  //保留（未使用）	
} IMAGE_BOUND_FORWARDER_REF, *PIMAGE_BOUND_FORWARDER_REF;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

VOID DisplayBoundImportTable(){
	DWORD dwSize = 0;
	DWORD dwFOA = 0;
	DWORD dwSizeOfDirectory = 0;
	LPVOID pFileBuffer = NULL;
	PIMAGE_DOS_HEADER pDosHeader = NULL; 
	PIMAGE_NT_HEADERS pNTHeader = NULL;
	PIMAGE_FILE_HEADER pPEHeader = NULL;
	PIMAGE_DATA_DIRECTORY pDataDirectory = NULL;
	PIMAGE_BOUND_IMPORT_DESCRIPTOR pBoundImportDescriptor = NULL;
	PIMAGE_BOUND_FORWARDER_REF pBoundImportRef = NULL;
	dwSize = ReadPEFile(path, &pFileBuffer);
	if(dwSize == 0 || !pFileBuffer){
		printf("Fail to read file\n");
		return ;
	}
	if(!isPE(pFileBuffer)){
		printf("Is not PE file!\n");
		return ;
	}
	pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
	pNTHeader = (PIMAGE_NT_HEADERS)((BYTE*)pFileBuffer + pDosHeader->e_lfanew);
	pPEHeader = &pNTHeader->FileHeader;
	if (pNTHeader->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64) {
    	PIMAGE_OPTIONAL_HEADER64 pOptionHeader = (PIMAGE_OPTIONAL_HEADER64)&pNTHeader->OptionalHeader;
    	dwSizeOfDirectory = pOptionHeader->NumberOfRvaAndSizes;
		pDataDirectory = pOptionHeader->DataDirectory;
	} else {
    	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)&pNTHeader->OptionalHeader;
    	dwSizeOfDirectory = pOptionHeader->NumberOfRvaAndSizes;
		pDataDirectory = pOptionHeader->DataDirectory;
	}
	dwFOA = RvaToFoa(pFileBuffer, pDataDirectory[11].VirtualAddress);	//定位绑定导入表
	pBoundImportDescriptor = (PIMAGE_BOUND_IMPORT_DESCRIPTOR)((BYTE*)pFileBuffer + dwFOA);
	auto dwNameBase = (DWORD_PTR)pBoundImportDescriptor;
	printf("***************BoundImportDescriptor***************\n");
	while(pBoundImportDescriptor->OffsetModuleName != 0){
		printf("TimeDateStamp: %x\n", pBoundImportDescriptor->TimeDateStamp);
		printf("OffsetModuleName: %s\n", (char*)((BYTE*)pFileBuffer + RvaToFoa(pFileBuffer, dwNameBase + pBoundImportDescriptor->OffsetModuleName)));
		printf("NumberOfModuleForwarderRefs: %x\n", pBoundImportDescriptor->NumberOfModuleForwarderRefs);
		DWORD temp = pBoundImportDescriptor->NumberOfModuleForwarderRefs;
		while(temp--){
			printf("--------------Ref--------------\n");
			pBoundImportRef = (PIMAGE_BOUND_FORWARDER_REF)((BYTE*)pBoundImportDescriptor + 8);
			pBoundImportDescriptor = (PIMAGE_BOUND_IMPORT_DESCRIPTOR)((BYTE*)pBoundImportDescriptor + 8);
			printf("	TimeDateStamp: %x\n", pBoundImportDescriptor->TimeDateStamp);
			printf("	OffsetModuleName: %s\n", dwNameBase + pBoundImportDescriptor->OffsetModuleName);
		}
		pBoundImportDescriptor = (PIMAGE_BOUND_IMPORT_DESCRIPTOR)((BYTE*)pBoundImportDescriptor + 8);
	}
	free(pFileBuffer);
}