//add_section.cpp

#include "windows.h"

#include "stdio.h"
//判断文件是否为合法PE文件
BOOL CheckPe(FILE* pFile)
{
fseek(pFile, 0, SEEK_SET);
BOOL bFlags = FALSE;
WORD IsMZ;
DWORD IsPE, pNT;
fread(&IsMZ, sizeof(WORD), 1, pFile);
if (IsMZ == 0x5A4D)
{
fseek(pFile, 0x3c, SEEK_SET);
fread(&pNT, sizeof(DWORD), 1, pFile);
fseek(pFile, pNT, SEEK_SET);
fread(&IsPE, sizeof(DWORD), 1, pFile);
if (IsPE == 0X00004550)
bFlags = TRUE;
else
bFlags = FALSE;
}
else
bFlags = FALSE;
fseek(pFile, 0, SEEK_SET);
return bFlags;
}

//用来计算对齐数据后的大小
int alig(int size, unsigned int align)
{
if (size%align != 0)
return (size / align + 1)*align;
else
return size;
}

int main(int argc, char argv[])
{
//if (argc != 2)
//{
// printf("\t\tusage:add_section filename\n");
// exit(-1);
//}
FILE rwFile;
if ((rwFile = fopen("D:\test\ConsoleApplication13.exe", "rb")) == NULL)//打开文件失败则退出
{
printf("\t\tOpen file faild\n");
exit(-1);
}

;
int nShellLen = sizeof(shellcode);
// x64 shellcode
//写入SHELLCODE,
for (i = 0; i < nShellLen; i++)
fputc(shellcode[i], newfile);
//SHELLCODE之后是跳转到原OEP的指令
NewSection.VirtualAddress = SEChea.VirtualAddress + alig(SEChea.Misc.VirtualSize, SECTION_ALIG);

}
跳不回原OEP

代码啊参考https://bbs.kanxue.com/thread-36497.htm
00fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8Y4q4I4i4K6g2X3y4o6b7$3y4e0M7^5z5e0W2Q4x3V1k6S2M7Y4c8A6j5$3I4W2i4K6u0r3k6r3g2@1j5h3W2D9M7#2)9J5c8U0p5J5y4o6V1&6x3o6j5$3y4#2)9K6c8Y4y4H3L8g2)9K6c8o6p5H3x3o6q4Q4x3X3f1J5x3e0l9I4i4K6u0W2x3K6l9H3x3g2)9J5k6e0j5$3y4e0m8Q4x3X3f1K6i4K6t1$3j5h3#2H3i4K6y4n7N6i4c8E0i4K6g2X3L8h3g2V1K9i4g2E0i4K6y4p5k6r3W2K6N6s2u0A6j5Y4g2@1k6g2)9J5k6i4m8U0i4K6g2X3M7X3g2D9k6i4k6S2L8Y4c8Q4x3X3g2F1L8$3&6W2i4K6u0V1N6r3q4K6K9#2)9J5k6r3u0D9L8$3N6Q4x3X3b7J5i4K6t1#2y4@1g2V1k6h3k6S2N6h3I4@1i4K6t1#2y4@1g2n7L8r3!0Y4b7$3!0E0L8h3g2F1k6p5k6J5L8$3#2n7j5h3W2V1N6g2)9J5y4e0N6q4f1X3q4@1k6g2)9J5k6o6y4Q4x3X3b7I4x3U0b7&6z5e0l9$3y4U0N6Q4x3X3c8T1L8r3!0Y4i4K6u0V1x3e0t1I4y4U0f1J5y4o6j5#2i4K6u0W2M7r3y4Q4y4h3k6J5k6h3I4W2N6X3q4F1N6q4)9#2k6U0y4E0L8%4c8Z5L8W2)9#2k6Y4y4@1M7X3q4@1k6h3N6&6i4K6g2X3j5h3&6V1i4K6g2X3k6r3q4@1j5g2)9#2k6Y4u0W2j5$3!0$3k6i4u0&6i4K6t1$3j5h3#2H3i4K6y4n7k6r3g2H3N6r3S2Q4y4h3j5I4i4K6u0V1N6i4c8E0i4K6g2X3M7$3!0#2M7X3y4W2i4K6y4p5k6r3W2K6N6s2u0A6j5Y4g2@1k6g2)9J5k6i4m8U0i4K6g2X3M7X3g2D9k6i4k6S2L8Y4c8Q4x3X3g2F1L8$3&6W2i4K6u0V1N6r3q4K6K9#2)9J5k6r3u0D9L8$3N6Q4x3X3b7J5i4K6t1#2y4@1g2V1k6h3k6S2N6h3I4@1i4K6t1#2y4@1g2n7L8r3!0Y4b7$3!0E0L8h3g2F1k6p5k6J5L8$3#2n7j5h3W2V1N6g2)9J5y4e0N6q4f1X3q4@1k6g2)9J5k6o6y4Q4x3X3b7I4x3U0b7&6z5e0l9$3y4U0N6Q4x3X3c8T1L8r3!0Y4i4K6u0V1x3e0t1I4y4U0f1J5y4o6j5#2i4K6u0W2M7r3y4Q4y4h3k6J5k6h3I4W2N6X3q4F1N6q4)9#2k6U0y4E0L8%4c8Z5L8W2)9#2k6Y4y4@1M7X3q4@1k6h3N6&6i4K6g2X3j5h3&6V1i4K6g2X3k6r3q4@1j5g2)9#2k6Y4u0W2j5$3!0$3k6i4u0&6i4K6t1$3j5h3#2H3i4K6y4n7N6i4c8E0i4K6g2X3M7X3g2D9k6i4k6S2L8Y4c8Q4y4h3k6A6L8X3c8W2P5q4)9K6c8o6j5`.

[培训]传播安全知识、拓宽行业人脉——看雪讲师团队等你加入！