能力值:
( LV2,RANK:10 )
|
-
-
2 楼
VS源代码调试之,很可能是你小的地址减去大地址,结果是负数转无符号就是很大的正数,哈哈!
|
能力值:
( LV6,RANK:80 )
|
-
-
3 楼
MySectionEnd真的比MySectionStart大吗...
|
能力值:
( LV8,RANK:150 )
|
-
-
4 楼
是ls说的问题,接着问啊,我的给文件添加一个节的代码如下,好像这里编译不过啊:
// 给文件添加一个小节
HANDLE hFile=CreateFile(mFileName,FILE_ALL_ACCESS,FILE_SHARE_READ | FILE_SHARE_WRITE,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
if(INVALID_HANDLE_VALUE==hFile)
{
MessageBox(L"CreateFile Error!");
return;
}
HANDLE hFileMap=CreateFileMapping(hFile,NULL,PAGE_READWRITE,0,0,NULL);
if(NULL==hFileMap)
{
MessageBox(L"CreateFileMapping Error!");
return;
}
LPVOID vStartAddr=MapViewOfFile(hFileMap,FILE_MAP_READ | FILE_MAP_WRITE,0,0,0);
if(NULL==vStartAddr)
{
MessageBox(L"MapViewOfFile Error!");
return;
}
PIMAGE_DOS_HEADER pDosHeader=(PIMAGE_DOS_HEADER)vStartAddr;
PIMAGE_NT_HEADERS pNtHeader=(PIMAGE_NT_HEADERS)(pDosHeader->e_lfanew+(DWORD)vStartAddr);//定位到NT头部
if(pNtHeader->Signature!=MAKEWORD(0x50,0x45))//PE标识
{
MessageBox(L"Invalid PE File!");
return;
}
PIMAGE_FILE_HEADER pFileHeader=&pNtHeader->FileHeader;
PIMAGE_OPTIONAL_HEADER pOptionHeader=&pNtHeader->OptionalHeader;
//pFileHeader->NumberOfSections++;//添加一个节,增加节数
PIMAGE_SECTION_HEADER pLastSectionHeader=(PIMAGE_SECTION_HEADER)((DWORD)pNtHeader+sizeof(IMAGE_NT_HEADERS)+(pFileHeader->NumberOfSections-1)*sizeof(IMAGE_SECTION_HEADER));
PIMAGE_SECTION_HEADER pNewSectionHeader=pLastSectionHeader+1;//新添加的节的地址
DWORD vFileAligh=pOptionHeader->FileAlignment;//文件中的对齐粒度
DWORD vSectionAligh=pOptionHeader->SectionAlignment;//节表对齐粒度
char *vNewSectionName=".MySec";
memcpy(pNewSectionHeader->Name,vNewSectionName,strlen(vNewSectionName));//设置新节的名称
pNewSectionHeader->NumberOfLinenumbers=0;//可能是对应到源文件中的行号,这个没有用,直接放0
pNewSectionHeader->NumberOfRelocations=0;//需要重定位的地址,这里暂时没有,直接放0
pNewSectionHeader->PointerToLinenumbers=0;
pNewSectionHeader->PointerToRelocations=0;
pNewSectionHeader->Characteristics=IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE;//设置这个节的属性
//新节的内容大小
DWORD vAddrStart=(DWORD)MySectionStart;
DWORD vAddrEnd=(DWORD)MySectionEnd;
DWORD vCodeSize=vAddrStart-vAddrEnd+sizeof(DWORD);
//下面根据文件对齐粒度计算这段代码的长度占用的大小
DWORD vCodeAlignCount=vCodeSize/vFileAligh;
DWORD vAlighLeft=vCodeSize%vFileAligh;
DWORD vCodeSizeForFileAlign=0;
if(vAlighLeft==0)//非常巧,正好是对齐粒度的整数倍
{
vCodeSizeForFileAlign=vCodeSize;
}
else
{
vCodeSizeForFileAlign=(vCodeAlignCount+1)*vFileAligh;
}
pNewSectionHeader->SizeOfRawData=vCodeSizeForFileAlign;
pNewSectionHeader->Misc.VirtualSize=vCodeSizeForFileAlign;
DWORD vLastSectionCodeSize=pLastSectionHeader->SizeOfRawData;
DWORD vLastSectionRawPointer=pLastSectionHeader->PointerToRawData;
DWORD vLastVirualAddr=pLastSectionHeader->VirtualAddress;
//计算一下上一个小节按照FileAlignment对齐之后占用的空间的大小
vCodeAlignCount=vLastSectionCodeSize/vFileAligh;
vAlighLeft=vLastSectionCodeSize%vFileAligh;
if(vAlighLeft==0)//正好对齐
vCodeSizeForFileAlign=vLastSectionCodeSize;
else
vCodeSizeForFileAlign=(vCodeAlignCount+1)*vFileAligh;
pNewSectionHeader->VirtualAddress=vLastVirualAddr+vCodeSizeForFileAlign;
pNewSectionHeader->PointerToRawData=vLastSectionRawPointer+vCodeSizeForFileAlign;//到这里为止,新的节表的表头设置完毕,下面按照上面计算出来的文件偏移地址写入新节的内容
memcpy((char*)(pNewSectionHeader->PointerToRawData+(DWORD)vStartAddr),(char*)((DWORD)MySectionStart+sizeof(DWORD)),vCodeSize);//写入
//对文件的其他字段设置
pNtHeader->FileHeader.NumberOfSections+=1;//文件小节数加1
pNtHeader->OptionalHeader.SizeOfImage+=vCodeSizeForFileAlign;//修改文件的大小
*(DWORD*)(pNewSectionHeader->PointerToRawData+(DWORD)vStartAddr)=pOptionHeader->AddressOfEntryPoint;//保存老的入口点
pOptionHeader->AddressOfEntryPoint=*(DWORD*)(pNewSectionHeader->PointerToRawData+sizeof(DWORD));//设置新的入口点
UnmapViewOfFile(vStartAddr);
CloseHandle(hFileMap);
CloseHandle(hFile);
MessageBox(L"添加小节完成!",L"提示",MB_OK);
OnCancel();
return;
_asm
{
vOldEntryPointAddress dd 0//(错误3)
MySectionStart:
call vNextAddr
vNextAddr:
pop ebx
add ebx,offset vOldEntryPointAddress - offset vNextAddr//(错误4)
mov eax,dword PTR[ebx]
jmp eax
MySectionEnd:
}
编译错误:
error C2065: 'MySectionStart' : undeclared identifier(错误1)
error C2065: 'MySectionEnd' : undeclared identifier(错误2)
error C2400: inline assembler syntax error in 'opcode'; found 'dd'(错误3)
error C2425: '-' : non-constant expression in 'second operand'(错误4)
|
能力值:
( LV6,RANK:80 )
|
-
-
5 楼
内联汇编不能用dd的............
|
能力值:
( LV8,RANK:150 )
|
-
-
6 楼
恩,改用几个4个 _EMIT 0指令
|