//add_section.cpp

#include "windows.h"

#include "stdio.h"
//判断文件是否为合法PE文件
BOOL CheckPe(FILE* pFile)
{
fseek(pFile, 0, SEEK_SET);
BOOL bFlags = FALSE;
WORD IsMZ;
DWORD IsPE, pNT;
fread(&IsMZ, sizeof(WORD), 1, pFile);
if (IsMZ == 0x5A4D)
{
fseek(pFile, 0x3c, SEEK_SET);
fread(&pNT, sizeof(DWORD), 1, pFile);
fseek(pFile, pNT, SEEK_SET);
fread(&IsPE, sizeof(DWORD), 1, pFile);
if (IsPE == 0X00004550)
bFlags = TRUE;
else
bFlags = FALSE;
}
else
bFlags = FALSE;
fseek(pFile, 0, SEEK_SET);
return bFlags;
}

//用来计算对齐数据后的大小
int alig(int size, unsigned int align)
{
if (size%align != 0)
return (size / align + 1)*align;
else
return size;
}

int main(int argc, char argv[])
{
//if (argc != 2)
//{
// printf("\t\tusage:add_section filename\n");
// exit(-1);
//}
FILE rwFile;
if ((rwFile = fopen("D:\test\ConsoleApplication13.exe", "rb")) == NULL)//打开文件失败则退出
{
printf("\t\tOpen file faild\n");
exit(-1);
}

;
int nShellLen = sizeof(shellcode);
// x64 shellcode
//写入SHELLCODE,
for (i = 0; i < nShellLen; i++)
fputc(shellcode[i], newfile);
//SHELLCODE之后是跳转到原OEP的指令
NewSection.VirtualAddress = SEChea.VirtualAddress + alig(SEChea.Misc.VirtualSize, SECTION_ALIG);

}
跳不回原OEP

代码啊参考https://bbs.kanxue.com/thread-36497.htm
https://blog.csdn.net/qq_44657899/article/details/124990667?spm=1001.2101.3001.6650.3&utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7EBlogCommendFromBaidu%7ERate-3-124990667-blog-121652465.pc_relevant_3mothn_strategy_and_data_recovery&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7EBlogCommendFromBaidu%7ERate-3-124990667-blog-121652465.pc_relevant_3mothn_strategy_and_data_recovery&utm_relevant_index=6

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！