//-------------------------------- 文件头 -------------------------------
FILE HEADER VALUES
14C machine (i386)
4 number of sections *** 重要的结构，这告诉我们这个obj文件有几个段，而我们关心的就是.text段
4C6DF71D time date stamp
125 file pointer to symbol table
10 number of symbols
0 size of optional header
0 characteristics
SECTION HEADER #1
.drectve name
0 physical address
0 virtual address
26 size of raw data
B4 file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
100A00 flags
Info
Remove
1 byte align
SECTION HEADER #2
.text name
0 physical address
0 virtual address
10 size of raw data -----> 段长度，也就是实际编码长度
DA file pointer to raw data -----> .text中代码，相对文件头部的偏移
EA file pointer to relocation table -----> 指向.text中需要重定位的数据指针
0 file pointer to line numbers
2 number of relocations -----> .text中代码，需要被修正的重定位数量
0 number of line numbers
60501020 flags
Code
Communal; sym= _main
16 byte align
Execute Read
RELOCATIONS #2
Symbol Symbol
Offset Type Applied To Index Name
-------- ---------------- ----------------- -------- ------
00000001 DIR32 00000000 D ??_C@_0N@NHHG@hello?5world?$CB?$AA@ (`string")
00000006 REL32 00000000 A _printf
SECTION HEADER #3
.data name
0 physical address
0 virtual address
D size of raw data
FE file pointer to raw data
0 file pointer to relocation table
0 file pointer to line numbers
0 number of relocations
0 number of line numbers
C0301040 flags
Initialized Data
Communal; sym= "`string"" (??_C@_0N@NHHG@hello?5world?$CB?$AA@)
4 byte align
Read Write
RAW DATA #3
00000000: 68 65 6C 6C 6F 20 77 6F 72 6C 64 21 00 hello world!.
SECTION HEADER #2
.text name
0 physical address
0 virtual address
D9 size of raw data ----> 长度已经被重新计算
26D file pointer to raw data ----> 指向了文件末尾
EA file pointer to relocation table ----> 没有修改原有重定位表
0 file pointer to line numbers
2 number of relocations
0 number of line numbers
60501020 flags
Code
Communal; sym= _main
16 byte align
Execute Read
//------------------------------------------------------------------------------
#include <stdio.h>
#include <string.h>
#include <malloc.h>
void vir_code(void);
void vir_code_end(void);
int main(int argc, char* argv[])
{
FILE *h = 0;
unsigned char *buf = 0;
int numread = 0;
int i = 0;
int f_size = 0;
int vir_size = 0;
int a_size = 0;
int tx_off = 0;
// coff-obj 文件头结构
typedef struct _coff_obj_header
{
short int magic;
short int sections;
long t_stamp;
long symbol_to_pointer;
long symbol_to_number;
short int optional_header;
short int ***s;
}coff_obj_header;
typedef struct _sec_hdr
{
char c_name[8]; // 段名
unsigned long ul_v_size; // 虚拟大小
unsigned long ul_v_addr; // 虚拟地址
unsigned long ul_sec_size; // 段长度
unsigned long ul_sec_off; // 段数据偏移
unsigned long ul_rel_off; // 段重定位表偏移
unsigned long ul_lno_off; // 行号表偏移
unsigned short ul_num_rel; // 重定位表个数
unsigned short ul_num_ln; // 行号表长度
unsigned long ul_flags; // 段标识
}sec_hdr;
typedef struct _reloc_s
{
unsigned long ul_off; // 定位偏移
unsigned long ul_symbol; // 符号
unsigned short us_type; // 定位类型
}reloc_s;
coff_obj_header coh_buf;
sec_hdr sh;
long tx_rel_off;
long tx_rel_len;
long txt_len;
long txt_off;
if (argc <2)
{
printf("please enter the obj file path to infection\n");
return 0;
}
if (0 == (h = fopen(argv[1],"r+")))
{
printf("the file %s was not opened\n",argv[2]);
return 0;
}
