#define ADD_LAST_SECTION  1   //添加代码到最后一个区段	
#define ADD_NEW_SECTION  2  //添加代码到一个新建的区段
#define ADD_TO_HEADER       3  //添加代码到PE头部
//除了以上3种外还有一种是寻找已存在区段空闲处并插入代码，这种插入PE头的修改更简单，只是比较容易失败，这里就不实现了
//这里再加一种字节补丁，针对一些简单的程序
#define	BYTE_PATCH		 4

HANDLE	hFile ;//文件句柄
HANDLE	hMap; //映射文件句柄

//////////////////////////////添加代码到最后一个区块/////////////////////////////////////

BOOL AddToLastSection(PBYTE lpMemory, DWORD dwFileSize)
{
	PIMAGE_NT_HEADERS		lpNtHeaders;
	PIMAGE_SECTION_HEADER	lpSectionHeader;
	PIMAGE_SECTION_HEADER	lpLastSectionHeader;
	DWORD					dwNewFileSize;		//最终文件大小
	DWORD					dwFileAlignSize;	//原文件对齐后大小
	DWORD					dwLastSectionAlignSize; //最后区段内存对齐后大小
	DWORD					dwPatchSize;		//补丁大小
	DWORD					dwFileAlign;		//文件对齐粒度
	DWORD					dwSectionAlign;		//内存对齐粒度
	//DWORD					dwLastSectionSize;
	//DWORD					dwPatchStart;	//指定补丁要复制到的文件偏移起始
	PBYTE					lpNewFile;		//最终文件缓存
	DWORD					dwSectionNum;

	lpNtHeaders		= (PIMAGE_NT_HEADERS)( lpMemory + ((PIMAGE_DOS_HEADER)lpMemory)->e_lfanew );
	lpSectionHeader	= (PIMAGE_SECTION_HEADER)(lpNtHeaders + 1);
	
	dwSectionNum = lpNtHeaders->FileHeader.NumberOfSections ;
	lpLastSectionHeader	= lpSectionHeader + dwSectionNum - 1;
	
	dwFileAlign		= lpNtHeaders->OptionalHeader.FileAlignment;
	dwSectionAlign	= lpNtHeaders->OptionalHeader.SectionAlignment;
	dwFileAlignSize	= Align(dwFileSize, dwFileAlign);	//求原文件对齐大小
	
	dwPatchSize		= ((DWORD)&Appendcode_End ) - ( (DWORD)&Appendcode_Start );	//获得补丁代码大小

	dwNewFileSize	= Align(dwFileAlignSize + dwPatchSize, dwFileAlign); //获得最终文件对齐后大小
	dwLastSectionAlignSize	= Align(lpLastSectionHeader->Misc.VirtualSize + dwPatchSize, dwSectionAlign); //获得内存中最后区段大小

	lpNewFile		= (PBYTE)VirtualAlloc (NULL, dwNewFileSize, MEM_COMMIT, PAGE_READWRITE);
	if ( !lpNewFile )  //分配内存失败
		return FALSE;

	//复制原文件数据
	memset(lpNewFile, 0, dwNewFileSize);
	memcpy(lpNewFile, lpMemory, dwFileSize);
	//复制完毕，关闭映射文件和句柄 (不关闭后面就无法创建新文件，本来想在AddCode关闭，结果试了抛异常什么的还是没用，只能hMap设置成全局变量然后在这关了，实在不雅观啊‘_’)
	UnmapViewOfFile(lpMemory);
	CloseHandle(hMap);
	CloseHandle(hFile);

	//复制补丁代码前先转储补丁数据
	PBYTE	pBuffer		= (PBYTE)(&Patch_Data);   //指向附加代码补丁数据处
	//(*(DWORD*)pBuffer)	= dwPatchNum; 
	memcpy(pBuffer + 4, dwPatchAddress, 16*sizeof(DWORD) );
	pBuffer	+= 4 + 16*sizeof(DWORD);
	memcpy(pBuffer, byOldData, 16);
	memcpy(pBuffer+16, byNewData, 16);

	//复制补丁代码
	memcpy(lpNewFile + dwFileAlignSize, &Appendcode_Start, dwPatchSize); 

	//修正PE头数据
	PIMAGE_NT_HEADERS		lpNewNtHeaders;
	PIMAGE_SECTION_HEADER	lpNewSectionHeader;
	PIMAGE_SECTION_HEADER	lpNewLastSection;
	DWORD*					lpNewEntry;			//指向新入口处
	DWORD					OldEntry;
	
	lpNewNtHeaders		= (PIMAGE_NT_HEADERS)( lpNewFile + ((PIMAGE_DOS_HEADER)lpNewFile)->e_lfanew );
	lpNewSectionHeader	= (PIMAGE_SECTION_HEADER)(lpNewNtHeaders + 1);
	lpNewLastSection	= lpNewSectionHeader + dwSectionNum - 1;

 	
	//给最后区段添加读写执行属性
	lpNewLastSection->Characteristics  |= 0xC0000020;
	
	//修正最后一个区段的偏移量
	lpNewLastSection->SizeOfRawData		= dwNewFileSize - lpNewLastSection->PointerToRawData;  
	lpNewLastSection->Misc.VirtualSize	= Align( GetValidSize(lpNewFile, lpNewLastSection), dwSectionAlign);//Align(lpNewLastSection->Misc.VirtualSize + dwPatchSize, dwSectionAlign) ;
	
	//修正镜像大小
	lpNewNtHeaders->OptionalHeader.SizeOfImage	= Align(lpNewLastSection->VirtualAddress + lpNewLastSection->Misc.VirtualSize, dwSectionAlign);

	//修正入口地址
	OldEntry	= lpNewNtHeaders->OptionalHeader.AddressOfEntryPoint;
	lpNewNtHeaders->OptionalHeader.AddressOfEntryPoint	= OffsetToRVA( (IMAGE_DOS_HEADER *)lpNewFile, dwFileAlignSize) ;
	
	//修正补丁代码跳回OEP的参数
	lpNewEntry			= (DWORD*)(lpNewFile + dwFileAlignSize + dwPatchSize - 5);
	*lpNewEntry			= OldEntry - (lpNewNtHeaders->OptionalHeader.AddressOfEntryPoint + dwPatchSize - 1); 

	//补丁完毕，写回文件
	HANDLE  hNewFile;
	DWORD	dwRead;
	if (INVALID_HANDLE_VALUE == ( hNewFile = CreateFile (szFileName, GENERIC_READ | GENERIC_WRITE , FILE_SHARE_READ , NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_ARCHIVE, NULL) ) )
		return FALSE;

	WriteFile(hNewFile, lpNewFile, dwNewFileSize, &dwRead, NULL);
	CloseHandle(hNewFile);
	return TRUE;
}
//这里再附上调用添加代码函数的主要函数，保证完整性
BOOL AddCode( )
{
	DWORD	dwFileSize;	//文件大小
	PBYTE	lpMemory;	//内存映射指针
	
	if (INVALID_HANDLE_VALUE != ( hFile = CreateFile (szFileName, GENERIC_READ , FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_ARCHIVE, NULL) ) )
	{
		dwFileSize	= GetFileSize (hFile, NULL);
		if (dwFileSize)
		{
			hMap	= CreateFileMapping (hFile, NULL, PAGE_READONLY, 0, 0, NULL);
			if (hMap)
			{
				lpMemory	= (BYTE *)MapViewOfFile (hMap, FILE_MAP_READ, 0, 0, 0);
				if (lpMemory)
				{
					//使用指定方法打补丁
					switch(dwTypeOfPatch)
					{
						case ADD_LAST_SECTION:
							if (!AddToLastSection(lpMemory, dwFileSize) )
								return FALSE;
							break;

						case ADD_NEW_SECTION:
							if (!AddToNewSection(lpMemory, dwFileSize) )
								return FALSE;
							break;

						case ADD_TO_HEADER:
							if (!AddToHeaderSection(lpMemory, dwFileSize) )
								return FALSE;
							break;

						case BYTE_PATCH:
							if (!BytePatch(lpMemory, dwFileSize))
								return FALSE;
							break;

					}
					
					return TRUE;
				}
				else
					MessageBox (GetActiveWindow() , TEXT("目标文件打开失败"), NULL, MB_OK);
			}
			else
				MessageBox ( GetActiveWindow() , TEXT("目标文件打开失败"), NULL, MB_OK);
		}
	}
	else
		MessageBox (GetActiveWindow() , TEXT("目标文件打开失败"), NULL, MB_OK);
	return FALSE;
}

assume fs:nothing
mov eax,fs:[30h]
mov eax,[eax+0ch]
mov esi,[eax+1ch]
lodsd
mov eax,[eax+8]

include		c:\masm32\include\windows.inc

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 导出变量供补丁工具使用
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;导出的变量
PUBLIC	Appendcode_Start	;附加代码起始处	
PUBLIC	Appendcode_End		;附加代码结束处
PUBLIC	Patch_Data		;补丁数据处

		.code
Appendcode_Start LABEL		DWORD

	jmp	_NewEntry

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;重要的函数名，为兼容WIN7 kernelbase.dll，使用LoadLibraryExA函数
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
szLoadLibraryExA db	'LoadLibraryExA',0  
szGetProcAddress db	'GetProcAddress',0

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;SEH错误Handler，用于在错误中回复并跳转到安全位置
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_SEHHandler proc _lpExceptionRecord,_lpSEH,_lpContext,_lpDispatchertext
	pushad
	mov	esi,_lpExceptionRecord
	assume	esi:ptr EXCEPTIONRECORD
	mov	edi,_lpContext
	assume	edi:ptr CONTEXT
	mov	eax,_lpSEH
	push	[eax+0ch]
	pop	[edi].regEbp
	push	[eax+08]
	pop	[edi].regEip
	push	eax
	pop	[edi].regEsp
	assume	edi:nothing,esi:nothing
	popad
	mov	eax,ExceptionContinueExecution
	ret
_SEHHandler endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;用PEB获取基址的方法,WIN7中获得的实际是kernelbase.dll的基地址
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_GetKernel32Base proc
	local	@dwRet

	pushad
	
	assume fs:nothing
	mov eax,fs:[30h]	;获取PEB所在地址
	mov eax,[eax+0ch]	;获取PEB_LDR_DATA 结构指针
	mov esi,[eax+1ch]	;获取InInitializationOrderModuleList 链表头
				;第一个LDR_MODULE节点InInitializationOrderModuleList成员的指针
	lodsd			;获取双向链表当前节点后继的指针
	mov eax,[eax+8]		;获取kernel32.dll的基地址(WIN7中是kernelbase.dll基址)
	mov @dwRet,eax
	popad
	
	mov eax,@dwRet
	ret
_GetKernel32Base endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;查找导出表获取指定API地址
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_GetApi	proc	_hModule,_lpszApi
	local	@dwReturn,@dwSize
	pushad
	
	call	@F
	@@:
	pop	ebx
	sub	ebx,@B
	
	assume	fs:nothing
	push	ebp
	push	[ebx+offset error]
	push	[ebx+offset _SEHHandler]
	push	fs:[0]
	mov	fs:[0],esp
	
	mov	edi,_lpszApi
	mov	ecx,-1
	xor	eax,eax
	cld
	repnz	scasb
	sub	edi,_lpszApi
	mov	@dwSize,edi

	mov	esi,_hModule
	add	esi,[esi+3ch]
	assume	esi:ptr IMAGE_NT_HEADERS
	mov	esi,[esi].OptionalHeader.DataDirectory.VirtualAddress
	add	esi,_hModule
	assume	esi:ptr IMAGE_EXPORT_DIRECTORY

	mov	ebx,[esi].AddressOfNames
	add	ebx,_hModule
	xor	edx,edx
	.while  edx <	[esi].NumberOfNames
		push	esi
		mov	edi,[ebx]
		add	edi,_hModule
		mov	esi,_lpszApi
		mov	ecx,@dwSize
		cld
		repz	cmpsb      ;搜索指定API的字符串
		.if	!ecx
			pop	esi
			jmp	@F  ;成功
		.endif
		next:
		pop	esi
		inc	edx
		add	ebx,4
	.endw
	jmp	error
	@@:
	sub	ebx,[esi].AddressOfNames         
	sub	ebx,_hModule     ;获得偏移
	shr	ebx,1                   ;由于索引数组是WORD数组，所以右移一位
	add	ebx,[esi].AddressOfNameOrdinals
	add	ebx,_hModule
	movzx	eax,word ptr [ebx]
	shl	eax,2                    ;将取得的索引左移2位获得字节偏移
	add	eax,[esi].AddressOfFunctions     
	add	eax,_hModule

	mov	eax,[eax]       ;取得目标API地址
	add	eax,_hModule
	mov	@dwReturn,eax
	error:
	pop	fs:[0]
	add	esp,0ch
	assume	esi:nothing
	popad
	mov	eax,@dwReturn
	ret
_GetApi endp

;补丁所需要的函数和全局变量
szCreateThread		db	'CreateThread',0
szGetTickCount		db	'GetTickCount',0
szVirtualProtect	db	'VirtualProtect',0
lpGetTickCount		dd	0
StartCount		dd	0

;以下变量需要补丁程序修正
Patch_Data	LABEL		DWORD
;dwTypeOfPatch	dd	0				;指示补丁类型
dwPatchNum	dd	0				;补丁数量	
dwPatchAddress	dd	16 dup(0)			;补丁地址
byOldData	db	16 dup(0)			;补丁处旧数据和新数据
byNewData	db	16 dup(0) 			

;这个线程是实现补丁的部分，循环检测补丁地址的数据并补丁，还加入了一个5分钟的超时检测
_Thread	proc	_lpVirtualProtect
	local	@lpGetTickCount,@temp,@StartCount,@num

	pushad
	call	@F
	@@:
	pop	ebx
	sub	ebx,@B
	mov	edx,dword ptr [ebx+offset lpGetTickCount]
	mov	@lpGetTickCount,edx
	mov	edx,dword ptr [ebx+offset StartCount]
	mov	@StartCount,edx

	mov	ecx,dword ptr [ebx+offset dwPatchNum]
	mov	@num,ecx
	.while	TRUE
		call	@lpGetTickCount
		sub	eax,@StartCount
		cmp	eax,493e0h		;大于五分钟则超时退出线程
		jg	_exit
		;开始检测补丁地址
		lea	esi,dword ptr [ebx+offset dwPatchAddress]  ;指向补丁地址
		lea	edi,dword ptr [ebx+offset byOldData]	   ;补丁处旧数据
		lea	edx,dword ptr [ebx+offset byNewData]	   ;补丁处新数据
		;检测所有补丁处字节
		mov	ecx,dword ptr [ebx+offset dwPatchNum]
		_peek:
			push	ecx
			mov	ecx,dword ptr [esi]	
			xor	eax,eax
			mov	al,byte  ptr [ecx]		;取补丁处数据
			cmp	al,byte  ptr [edi]		;补丁处是否解码
			jne	_mismatch
			
			;更改页面为读写执行,以确保补丁地址处拥有读写执行权限
			pushad
			lea		eax,@temp
			push	eax
			push	40h
			push	100h
			push	ecx
			call	_lpVirtualProtect
			popad		
			mov	al,byte ptr [edx]	;进行补丁
			mov	byte ptr [ecx],al
			dec	@num
			_mismatch:	
			inc	edi
			inc	edx
			add	esi,4
			pop	ecx
			cmp	@num,0
			je	_exit
		loop	_peek
	.endw
	_exit:
	popad
	ret
_Thread	endp


;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;补丁功能部分
;_dwKernelBase:		kernel32.dll基址
;_lpGetProcAddress:	GetProcAddress地址
;_lpLoadLibraryExA	LoadLibraryExA地址
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;这里的作用是获得一些必须的函数，然后创建补丁线程
_Patch	proc	_dwKernelBase,_lpGetProcAddress,_lpLoadLibraryExA
		local	@lpVirtualProtect		
		local	@temp

		pushad
		lea	edx,dword ptr [ebx+offset szVirtualProtect]
		push	edx
		push	_dwKernelBase
		call	_lpGetProcAddress
		cmp	eax,0
		je	_exit
		mov	@lpVirtualProtect,eax
		lea	edx,@temp
		push	edx
		push	40h
		push	1000h
		lea	edx,dword ptr [ebx+offset lpGetTickCount]
		push	edx
		call	@lpVirtualProtect   ;确保这个附加代码处全局变量位置可写
		lea	edx,dword ptr [ebx+offset szGetTickCount]
		push	edx
		push	_dwKernelBase
		call	_lpGetProcAddress
		.if	eax
			mov	dword ptr [ebx+offset lpGetTickCount],eax
			call	eax
			mov	dword ptr [ebx+offset StartCount],eax
			lea	edx,dword ptr [ebx+offset szCreateThread]
			push	edx
			push	_dwKernelBase
			call	_lpGetProcAddress
			.if	eax	
				lea		edx,@temp
				push	edx
				push	0
				push	@lpVirtualProtect				;线程参数为VirtualProtect函数的地址
				lea	edx,dword ptr [ebx+offset _Thread]
				push	edx
				push	0
				push	0
				call	eax	;创建监测线程进行补丁
			.endif
		.endif
		_exit:
		popad
		ret
_Patch	endp
;从导入表获得GetProcAddress函数和LoadLibraryExA函数地址
_start	proc
	local	@dwKernel32Base
	local	@lpGetProcAddress,@lpLoadLibraryExA
	
	pushad

	call	_GetKernel32Base
	.if	eax
		mov	@dwKernel32Base,eax
		lea	edx,dword ptr [ebx+offset szGetProcAddress]
		push	edx
		push	eax
		call	_GetApi
		mov	@lpGetProcAddress,eax
	.endif
	.if	@lpGetProcAddress
		lea	edx,dword ptr [ebx+offset szLoadLibraryExA]
		push	edx
		push	@dwKernel32Base
		call	@lpGetProcAddress
		.if	eax
			mov	@lpLoadLibraryExA,eax
			push	eax
			push	@lpGetProcAddress
			push	@dwKernel32Base
			call	_Patch
		.endif
	.endif

	popad
	xor	eax,eax
	ret
_start	endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;PE文件新入口
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_NewEntry:
	call	@F
	@@:
	pop	ebx
	sub	ebx,@B
	call	_start
	;ret
	jmpToStart db 0E9h,0F0h,0FFh,0ffh,0ffh	;需要补丁程序修正,放在这个位置只要在&Appencode-5处赋值就可以修正了，比较方便
	ret
Appendcode_End LABEL		DWORD
end

BOOL CALLBACK DialogProc (HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
{
	switch(message)
	{
		HANDLE_MSG(hDlg, WM_INITDIALOG, Main_OnInitDialog);
		HANDLE_MSG(hDlg, WM_COMMAND	, Main_OnCommand	);

		case WM_CLOSE:
			EndDialog (hDlg, 0);
			return true;
	}
	return FALSE;
}

//添加WIN7风格界面
#pragma comment(linker,"/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0'\processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*'\"")

//创建补丁文件，补丁模版以资源的形式存储在程序中
//参数:szPatchName:创建的补丁文件名     szFileName:目标文件名     lpPatchAddress:补丁地址数组  
//	   lpNewByte:补丁原始数据数组       lpNewByte:补丁新数据数组  dwTypeOfPatch:补丁类型
//	   dwPatchNum:补丁数量				ID:补丁模版的资源ID		  bCRC32:是否加入CRC32文件验证
BOOL CreatePatch(TCHAR szPatchName[ ], TCHAR szFileName[ ], DWORD lpPatchAddress[ ],BYTE lpOldByte[ ],BYTE lpNewByte[ ], DWORD	dwTypeOfPatch, DWORD dwPatchNum, DWORD ID, BOOL bCRC32 )
{
	static	char	secName[8] = ".sdata";
	DWORD	CRC32;
	if (bCRC32)		  //这里是CRC32的验证
	{
		CRC32 = GetCRC32(szFileName );
		if (!CRC32)
		{
			MessageBox(NULL, TEXT("CRC32提取出错"), NULL, 0);
			return FALSE;
		}
	}
	
	DWORD	dwResSize;
	PBYTE	lpResData;
	HGLOBAL	hGlobal;
	HRSRC hRes	= FindResource(hInst, MAKEINTRESOURCE(ID), L"PETYPE" );
	if (hRes)
	{
		dwResSize	= SizeofResource(hInst, hRes);
		hGlobal		= LoadResource(hInst, hRes);
		if (hGlobal )
		{
			lpResData	= (PBYTE)LockResource(hGlobal);
			if (lpResData )
			{

///////////////////////////////////开始写入文件并修正补丁中的参数//////////////////////////////////////////

				HANDLE					hFile, hMap;
				PBYTE					lpMemory;
				PIMAGE_NT_HEADERS		lpNtHeaders;
				PIMAGE_SECTION_HEADER	lpSectionHeader;
				PBYTE					lpSectionData;
				DWORD*					lpCRC32;
				DWORD					dwFileSize, dwRead, dwSectionNum;

				if (INVALID_HANDLE_VALUE != ( hFile = CreateFile (szPatchName, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_ARCHIVE, NULL) ) )
				{
					WriteFile(hFile, lpResData, dwResSize, &dwRead, NULL);    //写入文件
					dwFileSize	= GetFileSize (hFile, NULL);
					//修正数据
					if (dwFileSize)
					{
						hMap	= CreateFileMapping (hFile, NULL, PAGE_READWRITE, 0, 0, NULL);
						if (hMap)
						{
							lpMemory	= (BYTE *)MapViewOfFile (hMap, FILE_MAP_ALL_ACCESS, 0, 0, 0);
							if (lpMemory)
							{
								lpNtHeaders		= (PIMAGE_NT_HEADERS)(lpMemory + ((PIMAGE_DOS_HEADER)lpMemory)->e_lfanew);
								if (bCRC32)    //写CRC32值
								{
									lpCRC32			= (DWORD*)((PBYTE)(lpNtHeaders)-4);
									*lpCRC32		= CRC32;
								}
								dwSectionNum	= lpNtHeaders->FileHeader.NumberOfSections;
								lpSectionHeader	= (PIMAGE_SECTION_HEADER)(lpNtHeaders + 1);
								
								//查找需修正变量所在区段
								for (DWORD i=0; i < dwSectionNum; i++, lpSectionHeader++)
								{
									if ( !lstrcmpiA( (LPCSTR)lpSectionHeader->Name, secName) )
										break;
								}
								lpSectionData			= lpMemory + RvaToOffset( (PIMAGE_DOS_HEADER)lpMemory, lpSectionHeader->VirtualAddress);
////////////////////////////////////////////////////////////修正变量///////////////////////////////////////////////////////////////////////////
								int x;
								*(DWORD*)lpSectionData	= dwTypeOfPatch;
								*(DWORD*)(lpSectionData+4) = dwPatchNum;
								
								for(x=lstrlen(szFileName); x > 0; x--)
									if(szFileName[x] == TEXT('\\') )
										break;
								
								lstrcpy( (LPWSTR)(lpSectionData+8), &(szFileName[x]) );
								memcpy(lpSectionData+528, lpPatchAddress, ITEM_NUM*sizeof(DWORD));
								memcpy(lpSectionData+592, lpOldByte, ITEM_NUM*sizeof(BYTE));
								memcpy(lpSectionData+608, lpNewByte, ITEM_NUM*sizeof(BYTE));
////////////////////////////////////////////////////////////修正完毕////////////////////////////////////////////////////////////////////////////
								
								UnmapViewOfFile (lpMemory);
								CloseHandle (hMap);
								CloseHandle (hFile);
								return TRUE;
							}

						}

					}

				}
////////////////////////////////////////////////////////////////////////////////////////////////////////////

				return FALSE;
			}
		}
	}
	return FALSE;
}

#pragma optimize("",off)
//........函数体
#pragma optimize("",on)

BOOL CreateDiyPatch()
{
	static TCHAR	szStr[]= TEXT("创建自定义补丁"); 
	static char		szBuffer[1024];
	static TCHAR	szPatch[MAX_PATH];	
	static TCHAR	szCurrentDirectory[MAX_PATH];
	static TCHAR	szOriDirectory[MAX_PATH];
	HANDLE	hAsmFile, hAsmMap;
	PBYTE	lpMemory;
	DWORD	dwFileSize;
	int x;
	if (DIY_OK == FALSE)
		return FALSE;
	if ( PopFileSaveDlg (g_hWnd, g_szPatchName, szStr) )
	{
		GetCurrentDirectory(sizeof(szOriDirectory), szOriDirectory);
		GetModuleFileName(hInst, szPatch, sizeof(szPatch) );
		for(x=lstrlen(szPatch); x > 0; x--)
			if(szPatch[x] == TEXT('\\') )
				break;
		lstrcpy(szCurrentDirectory, szPatch);
		lstrcpy(&(szCurrentDirectory[x]), L"\\template\\");  //获得当前目录
		lstrcpy( &(szPatch[x]), TEXT("\\template\\patch"));
		if (INVALID_HANDLE_VALUE != ( hAsmFile = CreateFile ( szPatch, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ , NULL, OPEN_EXISTING, FILE_ATTRIBUTE_ARCHIVE, NULL) ) )
		{
			dwFileSize	= GetFileSize (hAsmFile, NULL);
			if (dwFileSize)
			{
				hAsmMap	= CreateFileMapping (hAsmFile, NULL, PAGE_READWRITE, 0, 0, NULL);
				if (hAsmMap)
				{
					lpMemory	= (BYTE *)MapViewOfFile (hAsmMap, FILE_MAP_ALL_ACCESS, 0, 0, 0);
					if (lpMemory)
					{
						memcpy(lpMemory, g_szUserCode, strlen( (char*)g_szUserCode) ); //复制自定义代码
						
						//下面代码用来隐藏控制台，要不编译链接的时候会一闪一闪，很难看
						TCHAR	szConsoleTitle[100];//控制台标题
						HWND	hCon;
						AllocConsole(); //分配产生一个控制台
						GetConsoleTitle(szConsoleTitle, sizeof(szConsoleTitle)); //获得控制台标题
						hCon=FindWindow(NULL, szConsoleTitle);
						ShowWindow(hCon, SW_HIDE);   //隐藏控制台
						
						//设置工作目录并编译连接，结果输出到_1.txt文件
						SetCurrentDirectory(szCurrentDirectory);
						system("ml /c /coff DiyPatch >> _1.txt");
						system("link /subsystem:windows DiyPatch.obj DiyPatch.res >> _1.txt");
						system("del DiyPatch.obj");
						MoveFile(L"DiyPatch.exe", g_szPatchName);
						memcpy(lpMemory, g_szBuffer, dwFileSize );//还原模版代码
						UnmapViewOfFile(lpMemory);
						CloseHandle(hAsmMap);
						CloseHandle(hAsmFile);

						FILE *pFile = fopen("_1.txt", "r+");   //提取_1.txt中存储的结果并显示对话框
						int	ch,i=0;
						if (pFile != NULL)
						{
							while((ch = fgetc(pFile) )!= EOF) 
							{
								if (ch == '\n')
									szBuffer[i++]='\r';
								szBuffer[i++]=ch;
							}
							MessageBoxA(g_hWnd, szBuffer, "生成结果", 0);
							fclose(pFile);
						}
						system("del _1.txt");
						SetCurrentDirectory(szOriDirectory); //还原工作目录
						return TRUE;
					}
					else	UnmapViewOfFile(lpMemory);
				}
				else	CloseHandle(hAsmMap);
			}
			else	CloseHandle(hAsmFile);
		}
	}
	return FALSE;
}

	InitPE32(L"Test.exe");
	AddCode(L"testnew2.exe", &APPEND_START, &APPEND_END-&APPEND_START, ADD_LAST_SECTION);//当然加上的补丁代码还是要自己用汇编写地~