首页
社区
课程
招聘
Pumqara's PE Library 0.3c
发表于: 2005-9-18 08:40 2797

Pumqara's PE Library 0.3c

2005-9-18 08:40
2797
This is a small library for handling the PE Header, Import Table, Export Table and Section Table of the Pe files. It is fully coded in MASM, so it is very fast and really small.

附件:pelibrary-0.3c.zip

[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法

收藏
免费 1
支持
分享
最新回复 (2)
雪    币: 211
活跃值: (40)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
THX
2005-9-18 22:22
0
雪    币: 93944
活跃值: (200229)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
3
针对该文件;

FORM Reverse-Engineering-Community

BY:Extrarius

I was trying your library and I found a bug with it I guess.
I wrote the following function.


#include <windows.h>
#include "PeLibrary.h"

typedef BOOL (WINAPI* LPFNPLOPENFILE)(DWORD,LPTSTR);
typedef DWORD (WINAPI* LPFNPLADDIMPORTS)(LPTSTR,LPTSTR);
typedef BOOL (WINAPI* LPFNPLCLOSEFILE)();

//-------------------------------------------------------------------------------------
bool AddImport( const char* FilePath, const char* LibraryName, const char* FuncName )
{
   if ( FilePath == NULL || LibraryName == NULL || FuncName == NULL )
   {
      return false;
   }

   HMODULE hModule = NULL;
   bool RetVal = false;

   try
   {
      hModule = LoadLibrary( "PeLibrary.dll" );
      if ( hModule != NULL )
      {
         LPFNPLOPENFILE   pOpenFile  = (LPFNPLOPENFILE)GetProcAddress( hModule, "plOpenFile" );
         LPFNPLCLOSEFILE  pCloseFile = (LPFNPLCLOSEFILE)GetProcAddress( hModule, "plCloseFile" );
         LPFNPLADDIMPORTS pAddImp    = (LPFNPLADDIMPORTS)GetProcAddress( hModule, "plAddImportFunction" );
         
         if ( pOpenFile != NULL && pCloseFile != NULL && pAddImp != NULL  )
         {            
            if ( pOpenFile( PL_NO_OPEN_DIALOG, (char*)FilePath ) )
            {               
               if ( pAddImp( (char*)LibraryName, (char*)FuncName ) )
               {
                  RetVal = true;
               }               
            }
            
            pCloseFile();
         }
      }
   }
   catch( ... )
   {
   }
   
   if ( hModule != NULL )
   {
      FreeLibrary( hModule );
   }
   
   return RetVal;
} 



Everything works fine until the line if ( pAddImp( (char*)LibraryName, (char*)FuncName ) ) gets executed. The functions creates a section named +Pumqara but it corrupts the file and gives an access violation error.

I tested the function with a simple console program made with VC++ 6
2006-4-20 17:47
0
游客
登录 | 注册 方可回帖
返回
//