首页
社区
课程
招聘
Pumqara's PE Library 0.3c
发表于: 2005-9-18 08:40 2798

Pumqara's PE Library 0.3c

2005-9-18 08:40
2798
This is a small library for handling the PE Header, Import Table, Export Table and Section Table of the Pe files. It is fully coded in MASM, so it is very fast and really small.

附件:pelibrary-0.3c.zip

[课程]Linux pwn 探索篇!

收藏
免费 1
支持
分享
最新回复 (2)
雪    币: 211
活跃值: (40)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
THX
2005-9-18 22:22
0
雪    币: 93944
活跃值: (200229)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
3
针对该文件;

FORM Reverse-Engineering-Community

BY:Extrarius

I was trying your library and I found a bug with it I guess.
I wrote the following function.


#include <windows.h>
#include "PeLibrary.h"

typedef BOOL (WINAPI* LPFNPLOPENFILE)(DWORD,LPTSTR);
typedef DWORD (WINAPI* LPFNPLADDIMPORTS)(LPTSTR,LPTSTR);
typedef BOOL (WINAPI* LPFNPLCLOSEFILE)();

//-------------------------------------------------------------------------------------
bool AddImport( const char* FilePath, const char* LibraryName, const char* FuncName )
{
   if ( FilePath == NULL || LibraryName == NULL || FuncName == NULL )
   {
      return false;
   }

   HMODULE hModule = NULL;
   bool RetVal = false;

   try
   {
      hModule = LoadLibrary( "PeLibrary.dll" );
      if ( hModule != NULL )
      {
         LPFNPLOPENFILE   pOpenFile  = (LPFNPLOPENFILE)GetProcAddress( hModule, "plOpenFile" );
         LPFNPLCLOSEFILE  pCloseFile = (LPFNPLCLOSEFILE)GetProcAddress( hModule, "plCloseFile" );
         LPFNPLADDIMPORTS pAddImp    = (LPFNPLADDIMPORTS)GetProcAddress( hModule, "plAddImportFunction" );
         
         if ( pOpenFile != NULL && pCloseFile != NULL && pAddImp != NULL  )
         {            
            if ( pOpenFile( PL_NO_OPEN_DIALOG, (char*)FilePath ) )
            {               
               if ( pAddImp( (char*)LibraryName, (char*)FuncName ) )
               {
                  RetVal = true;
               }               
            }
            
            pCloseFile();
         }
      }
   }
   catch( ... )
   {
   }
   
   if ( hModule != NULL )
   {
      FreeLibrary( hModule );
   }
   
   return RetVal;
} 



Everything works fine until the line if ( pAddImp( (char*)LibraryName, (char*)FuncName ) ) gets executed. The functions creates a section named +Pumqara but it corrupts the file and gives an access violation error.

I tested the function with a simple console program made with VC++ 6
2006-4-20 17:47
0
游客
登录 | 注册 方可回帖
返回
//