首页
社区
课程
招聘
Pumqara's PE Library 0.3c
发表于: 2005-9-18 08:40 2819

Pumqara's PE Library 0.3c

2005-9-18 08:40
2819
This is a small library for handling the PE Header, Import Table, Export Table and Section Table of the Pe files. It is fully coded in MASM, so it is very fast and really small.

附件:pelibrary-0.3c.zip

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!

收藏
免费 1
支持
分享
最新回复 (2)
雪    币: 211
活跃值: (40)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
THX
2005-9-18 22:22
0
雪    币: 97697
活跃值: (200834)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
3
针对该文件;

FORM Reverse-Engineering-Community

BY:Extrarius

I was trying your library and I found a bug with it I guess.
I wrote the following function.


#include <windows.h>
#include "PeLibrary.h"

typedef BOOL (WINAPI* LPFNPLOPENFILE)(DWORD,LPTSTR);
typedef DWORD (WINAPI* LPFNPLADDIMPORTS)(LPTSTR,LPTSTR);
typedef BOOL (WINAPI* LPFNPLCLOSEFILE)();

//-------------------------------------------------------------------------------------
bool AddImport( const char* FilePath, const char* LibraryName, const char* FuncName )
{
   if ( FilePath == NULL || LibraryName == NULL || FuncName == NULL )
   {
      return false;
   }

   HMODULE hModule = NULL;
   bool RetVal = false;

   try
   {
      hModule = LoadLibrary( "PeLibrary.dll" );
      if ( hModule != NULL )
      {
         LPFNPLOPENFILE   pOpenFile  = (LPFNPLOPENFILE)GetProcAddress( hModule, "plOpenFile" );
         LPFNPLCLOSEFILE  pCloseFile = (LPFNPLCLOSEFILE)GetProcAddress( hModule, "plCloseFile" );
         LPFNPLADDIMPORTS pAddImp    = (LPFNPLADDIMPORTS)GetProcAddress( hModule, "plAddImportFunction" );
         
         if ( pOpenFile != NULL && pCloseFile != NULL && pAddImp != NULL  )
         {            
            if ( pOpenFile( PL_NO_OPEN_DIALOG, (char*)FilePath ) )
            {               
               if ( pAddImp( (char*)LibraryName, (char*)FuncName ) )
               {
                  RetVal = true;
               }               
            }
            
            pCloseFile();
         }
      }
   }
   catch( ... )
   {
   }
   
   if ( hModule != NULL )
   {
      FreeLibrary( hModule );
   }
   
   return RetVal;
} 



Everything works fine until the line if ( pAddImp( (char*)LibraryName, (char*)FuncName ) ) gets executed. The functions creates a section named +Pumqara but it corrupts the file and gives an access violation error.

I tested the function with a simple console program made with VC++ 6
2006-4-20 17:47
0
游客
登录 | 注册 方可回帖
返回
//