以LordPE和OD成功加载为基础，清除PE头部中的“垃圾”数据
实际情况可能没多大用处，昨天晚上想温习一下PE头的格式就写了这个
使用时把PE文件拖进对话框即可
xp sp2 + VC6
附件:peclean.rar
#include "PeClean.h"
DWORD IsPE(HANDLE hFile)
{
char ReadBuffer[4];
DWORD dwRead;
DWORD dwOffset;
DWORD dwSizeOfHeader;
memset(ReadBuffer, 0, 4);
SetFilePointer(hFile, 0, NULL, FILE_BEGIN);
ReadFile(hFile, ReadBuffer, 4, &dwRead, NULL);
if (ReadBuffer[0]!='M' || ReadBuffer[1]!='Z')
{
return 0;
}
memset(ReadBuffer, 0, 4);
SetFilePointer(hFile, 0x3C, NULL, FILE_BEGIN);
ReadFile(hFile, &dwOffset, 4, &dwRead, NULL);
SetFilePointer(hFile, dwOffset, NULL, FILE_BEGIN);
ReadFile(hFile, ReadBuffer, 4, &dwRead, NULL);
if (ReadBuffer[0]!='P' || ReadBuffer[1]!='E')
{
return 0;
}
SetFilePointer(hFile, dwOffset+0x54, NULL, FILE_BEGIN);
ReadFile(hFile, &dwSizeOfHeader, 4, &dwRead, NULL);
return dwSizeOfHeader;
}
BYTE* ReadHeader(HANDLE hFile, DWORD dwSizeOfHeader)
{
BYTE* hMapOfHeader;
DWORD dwRead;
hMapOfHeader = VirtualAlloc(NULL, dwSizeOfHeader, MEM_COMMIT, PAGE_READWRITE);
if (NULL == hMapOfHeader)
{
return NULL;
}
SetFilePointer(hFile, 0, NULL, FILE_BEGIN);
ReadFile(hFile, hMapOfHeader, dwSizeOfHeader, &dwRead, NULL);
if (dwRead != dwSizeOfHeader)
{
VirtualFree(hMapOfHeader, 0, MEM_RELEASE);
return NULL;
}
return hMapOfHeader;
}
void WriteHeader(HANDLE hFile, BYTE* hMapOfHeader, DWORD dwSizeOfHeader)
{
DWORD dwWritten;
SetFilePointer(hFile, 0, NULL, FILE_BEGIN);
WriteFile(hFile, hMapOfHeader, dwSizeOfHeader, &dwWritten, NULL);
return ;
}
void BackupFile(char* szFileName)
{
BOOL bBackupFile;
char szBackupName[MAX_PATH];
bBackupFile = SendMessage(GetDlgItem(hWnd, IDC_CHECK_BAKFILE), BM_GETCHECK, 0, 0);
if (bBackupFile)
{
strcpy(szBackupName, szFileName);
strcat(szBackupName, ".bak");
CopyFile(szFileName, szBackupName, FALSE);
}
return ;
}
void CleanDosHeader(BYTE* hMapOfHeader)
{
BOOL bMZ;
BYTE* i;
bMZ = SendMessage(GetDlgItem(hWnd, IDC_CHECK_MZ), BM_GETCHECK, 0, 0) ^ 1;
for (i=hMapOfHeader+2; i<(BYTE *)peHeader; i++)
{
(*i) *= bMZ;
}
*(LPWORD)(hMapOfHeader+0x3C) = (WORD)((BYTE *)peHeader-hMapOfHeader);
return ;
}
void CleanFileHeader(BYTE* hMapOfHeader)
{
peHeader->FileHeader.TimeDateStamp *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_FILE1), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->FileHeader.PointerToSymbolTable *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_FILE2), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->FileHeader.NumberOfSymbols *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_FILE3), BM_GETCHECK, 0, 0) ^ 1 ;
return ;
}
void CleanOptionalHeader(BYTE* hMapOfHeader)
{
peHeader->OptionalHeader.MajorLinkerVersion *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL1), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.MinorLinkerVersion *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL1), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.MajorOperatingSystemVersion *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL2), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.MinorOperatingSystemVersion *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL2), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.SizeOfCode *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL3), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.SizeOfInitializedData *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL4), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.SizeOfUninitializedData *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL4), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.BaseOfCode *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL5), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.BaseOfData *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL6), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.MajorImageVersion *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL7), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.MinorImageVersion *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL7), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.Win32VersionValue *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL8), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.CheckSum *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL9), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.LoaderFlags *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL10), BM_GETCHECK, 0, 0) ^ 1 ;
peHeader->OptionalHeader.DllCharacteristics *=
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL11), BM_GETCHECK, 0, 0) ^ 1 ;
return ;
}
void CleanFile(char* szFileName)
{
HANDLE hFile;
DWORD dwSizeOfHeader;
BYTE* hMapOfHeader;
hFile = CreateFile(szFileName,
GENERIC_READ+GENERIC_WRITE,
FILE_SHARE_READ+FILE_SHARE_WRITE,
0,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,NULL);
if (hFile == INVALID_HANDLE_VALUE)
{
MessageBox(hWnd, "Cannot Open the File", "Error", 0);
return ;
}
dwSizeOfHeader = IsPE(hFile);
if (dwSizeOfHeader == 0)
{
CloseHandle(hFile);
MessageBox(hWnd, "Invalid PE File", "Error", 0);
return ;
}
hMapOfHeader = ReadHeader(hFile, dwSizeOfHeader);
if (NULL == hMapOfHeader)
{
CloseHandle(hFile);
MessageBox(hWnd, "Cannot Read PeHeader", "Error", 0);
return ;
}
peHeader = (IMAGE_NT_HEADERS32 *)(hMapOfHeader + *(LPWORD)(hMapOfHeader+0x3C));
BackupFile(szFileName);
CleanDosHeader(hMapOfHeader);
CleanFileHeader(hMapOfHeader);
CleanOptionalHeader(hMapOfHeader);
*(LPWORD)(hMapOfHeader+0x3C) = (WORD)((BYTE *)peHeader-hMapOfHeader);
WriteHeader(hFile, hMapOfHeader, dwSizeOfHeader);
VirtualFree(hMapOfHeader, 0, MEM_RELEASE);
CloseHandle(hFile);
MessageBox(hWnd, "Done!", "ok", 0);
return ;
}
void SetCheck(BOOL bFlag)
{
SendMessage(GetDlgItem(hWnd, IDC_CHECK_BAKFILE) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_MZ) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_FILE1) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_FILE2) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_FILE3) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL1) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL2) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL3) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL4) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL5) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL6) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL7) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL8) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL9) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL10) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_OPTIONAL11) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_ALL) , BM_SETCHECK, bFlag, 0);
SendMessage(GetDlgItem(hWnd, IDC_CHECK_NONE) , BM_SETCHECK, bFlag^1, 0);
}
int CALLBACK DlgProc(HWND hDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
switch (uMsg)
{
case WM_CLOSE:
PostQuitMessage(0);
break;
case WM_INITDIALOG:
hWnd = hDlg;
hIcon = LoadIcon(hInst, MAKEINTRESOURCE(IDI_ICON1));
SendMessage(hWnd, WM_SETICON, (WPARAM)TRUE, (LPARAM)hIcon);
SetCheck(TRUE);
break;
case WM_DROPFILES:
if (DragQueryFile((HDROP)wParam, 0, szFileName, MAX_PATH))
{
CleanFile(szFileName);
}
break;
case WM_COMMAND:
if (lParam == GetDlgItem(hWnd, IDC_CHECK_ALL))
{
SetCheck(1);
}
else if (lParam == GetDlgItem(hWnd, IDC_CHECK_NONE))
{
SetCheck(0);
}
break;
default:
break;
}
return 0;
}
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR szCmdLine, int iCmdShow)
{
InitCommonControls();
hInst = hInstance;
DialogBox(hInst, MAKEINTRESOURCE(IDD_DIALOG_PECLEAN), NULL, (DLGPROC)DlgProc);
return 0;
}
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
