[原创]PE文件添加区段[逆向分析+asm代码实现]-软件逆向-看雪论坛-安全社区|安全招聘|bbs.pediy.com

[原创]PE文件添加区段[逆向分析+asm代码实现]

2008-11-23 06:26 9414

[原创]PE文件添加区段[逆向分析+asm代码实现]

himcrack

2008-11-23 06:26

9414

【文章标题】: PE文件添加区段[逆向分析+asm代码实现]
【文章作者】: eASYSCt
【作者主页】: http://blog.sina.com.cn/77muyulong
【软件名称】: zeroadd
【下载地址】: 自己搜索下载
【加壳方式】: 无壳
【保护方式】: 无
【编写语言】: 汇编
【使用工具】: ODB
【软件介绍】: 一款为PE文件添加区段的小工具
【作者声明】: 只是为学习原理并无其他目的大侠指教~

【详细过程】

闲来无事逛至编程区发现了好多教程其中专题系列更是十分值得学习看了玩命大侠的第一篇文章
【成果6.1】软件保护壳技术专题 - 添加新节
http://bbs.pediy.com/showthread.php?p=467116
之后才明白自己为何平时用LDPE给文件加区段总是失败呵呵自以为收益颇丰

转念一想平时常用一工具名曰zeroadd 跟文中提到之方甚为相似遂肢解其文件以求知

撰写此文仅为笔记高手嘲笑之余望指点一二愚弟拜谢……

此工具可谓清晰之至 win32ASM写的反汇编出来基本根源码一样奈何自己只是一只小菜虫研究了整整一个晚上~

首先是看下流程

摘自玩命大侠壳专题文章

添加新节相关的PE头属性:
位于IMAGE_NT_HEADERS结构中的属性:
ImageBase(4字节)
SizeOfImage(4字节)
NumberOfSections(2字节)
AddressOfEntryPoint(4字节)
SectionAlignment(4字节)
FileAlignment(4字节)

位于IMAGE_SECTION_HEADER结构的属性:
最后节表VirtualSize(4字节)
最后节表的VirtualAddress(4字节)
最后节表的SizeOfRawData(4字节)
最后节表的PointerToRawData(4字节)
最后节表的Characteristics(4字节)

添加新节算法描述:
1.建立文件映射
2.判断是否是PE文件
3.移动到最后一个节表
4.添加新节节表
5.设置新节的VirtualAddress,VirtualSize,SizeOfRawData,PointerToRawData,Characteristics等属性
※6.将新节的内容写入文件
7.增加NumberOfSections属性
8.设置SizeOfImage,AddressOfEntryPoint属性
9.将内存映射回文件

其中第6条略过因为在本文这不是重点。。

了解了大概思路就要开始动手了

OD加载zercadd.exe

先看主体函数

[SIZE=2]00401000 z>/$  6A 00              push    0                                 ; /pModule = NULL[/SIZE]
[SIZE=2]00401002   |.  E8 7F050000        call      ; \GetModuleHandleA[/SIZE]
[SIZE=2]00401007   |.  6A 00              push    0                                 ; /lParam = NULL[/SIZE]
[SIZE=2]00401009   |.  68 1F104000        push    0040101F                          ; |DlgProc = zeroadd.0040101F[/SIZE]
[SIZE=2]0040100E   |.  6A 00              push    0                                 ; |hOwner = NULL[/SIZE]
[SIZE=2]00401010   |.  6A 01              push    1                                 ; |pTemplate = 1[/SIZE]
[SIZE=2]00401012   |.  50                 push    eax                               ; |hInst[/SIZE]
[SIZE=2]00401013   |.  E8 20050000        call         ; \DialogBoxParamA[/SIZE]
[SIZE=2]00401018   |.  6A 00              push    0                                 ; /ExitCode = 0[/SIZE]
[SIZE=2]0040101A   \.  E8 5B050000        call           ; \ExitProcess[/SIZE]

哈哈会编写的果然好看上去一目了然

DialogBoxParamA的参数hInst为上面GetModuleHandleA得到的返回值 pTemplate为对话框资源ID DlgProc为对话框主函数体

我们跟随到主函数看看

又是很清晰的代码

主函数体很长只做有用的摘录

[SIZE=2]00401030   |> \837D 0C 10         cmp     dword ptr [ebp+C], 10[/SIZE]
[SIZE=2]00401034   |.  75 0F              jnz     short 00401045[/SIZE]
[SIZE=2]00401036   |.  6A 00              push    0                                 ; /Result = 0[/SIZE]
[SIZE=2]00401038   |.  FF75 08            push    dword ptr [ebp+8]                 ; |hWnd[/SIZE]
[SIZE=2]0040103B   |.  E8 FE040000        call               ; \EndDialog[/SIZE]

判断消息是否为WM_CLOSE 是的话不跳 call EndDialog结束对话框

[SIZE=2]00401045   |> \817D 0C 11010000   cmp     dword ptr [ebp+C], 111[/SIZE]
[SIZE=2]0040104C   |.  0F85 31040000      jnz     00401483[/SIZE]
[SIZE=2]00401052   |.  8B45 10            mov     eax, dword ptr [ebp+10][/SIZE]
[SIZE=2]00401055   |.  66:83F8 02         cmp     ax, 2[/SIZE]
[SIZE=2]00401059   |.  75 58              jnz     short 004010B3[/SIZE]
[SIZE=2]0040105B   |.  C1E8 10            shr     eax, 10[/SIZE]
[SIZE=2]0040105E   |.  66:0BC0            or      ax, ax[/SIZE]
[SIZE=2]00401061   |.  75 50              jnz     short 004010B3[/SIZE]
[SIZE=2]00401063   |.  C705 F3324000 4C00>mov     dword ptr [4032F3], 4C[/SIZE]
[SIZE=2]0040106D   |.  C705 FF324000 3F33>mov     dword ptr [4032FF], 0040333F      ;  ASCII "Executable Files (*.exe, *.dll)"[/SIZE]
[SIZE=2]00401077   |.  C705 0F334000 7C33>mov     dword ptr [40330F], 0040337C[/SIZE]
[SIZE=2]00401081   |.  C705 13334000 0002>mov     dword ptr [403313], 200[/SIZE]
[SIZE=2]0040108B   |.  C705 27334000 0418>mov     dword ptr [403327], 281804[/SIZE]
[SIZE=2]00401095   |.  68 F3324000        push    004032F3                          ; /pOpenFileName = zeroadd.004032F3[/SIZE]
[SIZE=2]0040109A   |.  E8 11050000        call      ; \GetOpenFileNameA[/SIZE]

判断消息是否为WM_COMMAND 是则不跳判断是否ID=2按下之后初始化ofn结构调用GetOpenFileNameA函数用系统对话框获得文件名

onf结构

typedef struct tagOFN {
DWORD lStructSize;
HWND hwndOwner;
HINSTANCE hInstance;
LPCTSTR lpstrFilter;
LPTSTR lpstrCustomFilter;
DWORD nMaxCustFilter;
DWORD nFilterIndex;
LPTSTR lpstrFile;
DWORD nMaxFile;
LPTSTR lpstrFileTitle;
DWORD nMaxFileTitle;
LPCTSTR lpstrInitialDir;
LPCTSTR lpstrTitle;
DWORD Flags;
WORD nFileOffset;
WORD nFileExtension;
LPCTSTR lpstrDefExt;
LPARAM lCustData;
LPOFNHOOKPROC lpfnHook;
LPCTSTR lpTemplateName;
#if (_WIN32_WINNT >= 0x0500)
void * pvReserved;
DWORD dwReserved;
DWORD FlagsEx;
#endif // (_WIN32_WINNT >= 0x0500)
} OPENFILENAME, *LPOPENFILENAME;

VC++的介绍详见 http://dev.csdn.net/article/13/13461.shtm

[SIZE=2]004010A4   |.  68 7C334000        push    0040337C                          ; /Text = ""[/SIZE]
[SIZE=2]004010A9   |.  6A 03              push    3                                 ; |ControlID = 3[/SIZE]
[SIZE=2]004010AB   |.  FF75 08            push    dword ptr [ebp+8]                 ; |hWnd[/SIZE]
[SIZE=2]004010AE   |.  E8 A3040000        call         ; \SetDlgItemTextA[/SIZE]

得到文件名后将其显示到ID=3的EDIT控件里

[SIZE=2]004010B3   |> \66:83F8 06         cmp     ax, 6[/SIZE]
[SIZE=2]004010B7   |.  0F85 7A030000      jnz     00401437[/SIZE]
[SIZE=2]004010BD   |.  C1E8 10            shr     eax, 10[/SIZE]
[SIZE=2]004010C0   |.  66:0BC0            or      ax, ax[/SIZE]
[SIZE=2]004010C3   |.  0F85 6E030000      jnz     00401437[/SIZE]
[SIZE=2]004010C9   |.  68 00020000        push    200                               ; /Count = 200 (512.)[/SIZE]
[SIZE=2]004010CE   |.  68 20304000        push    00403020                          ; |Buffer = zeroadd.00403020[/SIZE]
[SIZE=2]004010D3   |.  6A 03              push    3                                 ; |ControlID = 3[/SIZE]
[SIZE=2]004010D5   |.  FF75 08            push    dword ptr [ebp+8]                 ; |hWnd[/SIZE]
[SIZE=2]004010D8   |.  E8 67040000        call         ; \GetDlgItemTextA[/SIZE]
[SIZE=2]004010DD   |.  68 00020000        push    200                               ; /Count = 200 (512.)[/SIZE]
[SIZE=2]004010E2   |.  68 00304000        push    00403000                          ; |Buffer = zeroadd.00403000[/SIZE]
[SIZE=2]004010E7   |.  6A 04              push    4                                 ; |ControlID = 4[/SIZE]
[SIZE=2]004010E9   |.  FF75 08            push    dword ptr [ebp+8]                 ; |hWnd[/SIZE]
[SIZE=2]004010EC   |.  E8 53040000        call         ; \GetDlgItemTextA[/SIZE]
[SIZE=2]004010F1   |.  68 00020000        push    200                               ; /Count = 200 (512.)[/SIZE]
[SIZE=2]004010F6   |.  68 08304000        push    00403008                          ; |Buffer = zeroadd.00403008[/SIZE]
[SIZE=2]004010FB   |.  6A 05              push    5                                 ; |ControlID = 5[/SIZE]
[SIZE=2]004010FD   |.  FF75 08            push    dword ptr [ebp+8]                 ; |hWnd[/SIZE]
[SIZE=2]00401100   |.  E8 3F040000        call         ; \GetDlgItemTextA[/SIZE]
[SIZE=2]00401105   |.  6A 0F              push    0F                                ; /ButtonID = F (15.)[/SIZE]
[SIZE=2]00401107   |.  FF75 08            push    dword ptr [ebp+8]                 ; |hWnd[/SIZE]
[SIZE=2]0040110A   |.  E8 3B040000        call      ; \IsDlgButtonChecked[/SIZE]

如果按下的是ID=6的BUTTEN 则读取三个EDIT控件的文字和一个CheckBox的状态
它们分别是完整文件名补区段的段名段的大小和是否备份源文件

[SIZE=2]0040110F   |.  83F8 01            cmp     eax, 1[/SIZE]
[SIZE=2]00401112   |.  75 38              jnz     short 0040114C[/SIZE]
[SIZE=2]00401114   |.  68 20304000        push    00403020                          ; /String2 = ""[/SIZE]
[SIZE=2]00401119   |.  68 85304000        push    00403085                          ; |String1 = zeroadd.00403085[/SIZE]
[SIZE=2]0040111E   |.  E8 81040000        call              ; \lstrcpyA[/SIZE]
[SIZE=2]00401123   |.  68 1B314000        push    0040311B                          ; /StringToAdd = ".bak"[/SIZE]
[SIZE=2]00401128   |.  68 85304000        push    00403085                          ; |ConcatString = ""[/SIZE]
[SIZE=2]0040112D   |.  E8 6C040000        call              ; \lstrcatA[/SIZE]
[SIZE=2]00401132   |.  6A 00              push    0                                 ; /FailIfExists = FALSE[/SIZE]
[SIZE=2]00401134   |.  68 85304000        push    00403085                          ; |NewFileName = ""[/SIZE]
[SIZE=2]00401139   |.  68 20304000        push    00403020                          ; |ExistingFileName = ""[/SIZE]
[SIZE=2]0040113E   |.  E8 1F040000        call             ; \CopyFileA[/SIZE]
[SIZE=2]00401143   |.  83F8 00            cmp     eax, 0[/SIZE]
[SIZE=2]00401146   |.  0F84 51020000      je      0040139D[/SIZE]
[SIZE=2]0040114C   |>  6A 00              push    0                                 ; /FailIfExists = FALSE[/SIZE]
[SIZE=2]0040114E   |.  68 29314000        push    00403129                          ; |NewFileName = "swapit.sca"[/SIZE]
[SIZE=2]00401153   |.  68 20304000        push    00403020                          ; |ExistingFileName = ""[/SIZE]
[SIZE=2]00401158   |.  E8 05040000        call             ; \CopyFileA[/SIZE]

如果call IsDlgButtonChecked的返回结构是1就是说明选中了备份文件那么复制完整文件名再文件名后面加上".bak"
之后拷贝文件即完成了原文件的备份工作呵呵很简单哦~

再之后过程就和玩命大侠在文中叙述的几乎一样了由于玩命大侠写得太清楚透彻了我不再赘述以免班门弄斧…

不过有一个函数引起了我的注意

[SIZE=2]00401190   |.  68 08304000        push    00403008                          ; /Arg1 = 00403008[/SIZE]
[SIZE=2]00401195   |.  E8 13030000        call    Hex>                      ; \zeroadd.004014AD[/SIZE]

标签是我后来加的原来是call 004014AD 这是这个程序为数不多的自己写的函数

跟过去看个究竟看看他到底是干什么的

[SIZE=2]004014AD <>/$  55                 push    ebp[/SIZE]
[SIZE=2]004014AE   |.  8BEC               mov     ebp, esp[/SIZE]
[SIZE=2]004014B0   |.  83C4 FC            add     esp, -4[/SIZE]
[SIZE=2]004014B3   |.  53                 push    ebx[/SIZE]
[SIZE=2]004014B4   |.  51                 push    ecx[/SIZE]
[SIZE=2]004014B5   |.  57                 push    edi[/SIZE]
[SIZE=2]004014B6   |.  52                 push    edx[/SIZE]
[SIZE=2]004014B7   |.  56                 push    esi[/SIZE]
[SIZE=2]004014B8   |.  C745 FC 00000000   mov     dword ptr [ebp-4], 0[/SIZE]
[SIZE=2]004014BF   |.  33C9               xor     ecx, ecx[/SIZE]
[SIZE=2]004014C1   |.  8B7D 08            mov     edi, dword ptr [ebp+8][/SIZE]
[SIZE=2]004014C4   |.  FF75 08            push    dword ptr [ebp+8]                 ; /String[/SIZE]
[SIZE=2]004014C7   |.  E8 DE000000        call              ; \lstrlenA[/SIZE]
[SIZE=2]004014CC   |.  BB 10000000        mov     ebx, 10[/SIZE]
[SIZE=2]004014D1   |.  8BF0               mov     esi, eax[/SIZE]
[SIZE=2]004014D3   |.  EB 35              jmp     short 0040150A[/SIZE]
[SIZE=2]004014D5   |>  8A07               /mov     al, byte ptr [edi][/SIZE]
[SIZE=2]004014D7   |.  3C 30              |cmp     al, 30                           ;  Switch (cases 30..39)[/SIZE]
[SIZE=2]004014D9   |.  72 08              |jb      short 004014E3                   ;  小于30跳[/SIZE]
[SIZE=2]004014DB   |.  3C 39              |cmp     al, 39[/SIZE]
[SIZE=2]004014DD   |.  77 04              |ja      short 004014E3                   ;  大于39跳[/SIZE]
[SIZE=2]004014DF   |.  2C 30              |sub     al, 30                           ;  不跳就-30即为0~9[/SIZE]
[SIZE=2]004014E1   |.  EB 12              |jmp     short 004014F5[/SIZE]
[SIZE=2]004014E3   |>  3C 61              |cmp     al, 61                           ;  Default case of switch 004014D7[/SIZE]
[SIZE=2]004014E5   |.  72 0A              |jb      short 004014F1[/SIZE]
[SIZE=2]004014E7   |.  3C 66              |cmp     al, 66[/SIZE]
[SIZE=2]004014E9   |.  77 06              |ja      short 004014F1[/SIZE]
[SIZE=2]004014EB   |.  2C 61              |sub     al, 61[/SIZE]
[SIZE=2]004014ED   |.  04 0A              |add     al, 0A[/SIZE]
[SIZE=2]004014EF   |.  EB 04              |jmp     short 004014F5[/SIZE]
[SIZE=2]004014F1   |>  2C 41              |sub     al, 41[/SIZE]
[SIZE=2]004014F3   |.  04 0A              |add     al, 0A[/SIZE]
[SIZE=2]004014F5   |>  0FB6C0             |movzx   eax, al                          ;  Cases 30 ('0'),31 ('1'),32 ('2'),33 ('3'),34 ('4'),35 ('5'),36 ('6'),37 ('7'),38 ('8'),39 ('9') of switch 004014D7[/SIZE]
[SIZE=2]004014F8   |.  8BCE               |mov     ecx, esi[/SIZE]
[SIZE=2]004014FA   |.  49                 |dec     ecx[/SIZE]
[SIZE=2]004014FB   |.  EB 03              |jmp     short 00401500[/SIZE]
[SIZE=2]004014FD   |>  F7E3               |/mul     ebx[/SIZE]
[SIZE=2]004014FF   |.  49                 ||dec     ecx[/SIZE]
[SIZE=2]00401500   |>  83F9 00            | cmp     ecx, 0[/SIZE]
[SIZE=2]00401503   |.^ 77 F8              |\ja      short 004014FD[/SIZE]
[SIZE=2]00401505   |.  0145 FC            |add     dword ptr [ebp-4], eax[/SIZE]
[SIZE=2]00401508   |.  47                 |inc     edi[/SIZE]
[SIZE=2]00401509   |.  4E                 |dec     esi[/SIZE]
[SIZE=2]0040150A   |>  0BF6                or      esi, esi[/SIZE]
[SIZE=2]0040150C   |.^ 75 C7              \jnz     short 004014D5[/SIZE]
[SIZE=2]0040150E   |.  8B45 FC            mov     eax, dword ptr [ebp-4][/SIZE]
[SIZE=2]00401511   |.  5E                 pop     esi[/SIZE]
[SIZE=2]00401512   |.  5A                 pop     edx[/SIZE]
[SIZE=2]00401513   |.  5F                 pop     edi[/SIZE]
[SIZE=2]00401514   |.  59                 pop     ecx[/SIZE]
[SIZE=2]00401515   |.  5B                 pop     ebx[/SIZE]
[SIZE=2]00401516   |.  C9                 leave[/SIZE]
[SIZE=2]00401517   \.  C2 0400            retn    4[/SIZE]

一个完整的小函数设计的相当精巧类似于

[SIZE=2]long Fanc(LPSTR)[/SIZE]
[SIZE=2]{[/SIZE]
[SIZE=2]long dwM;[/SIZE]
[SIZE=2]....[/SIZE]
[SIZE=2]...[/SIZE]
[SIZE=2]..[/SIZE]
[SIZE=2].[/SIZE]
[SIZE=2]}[/SIZE]

传入的参数是ID=5的EDIT里面的字符串这个EDIT里面是我们输入的区段大小猜想都可以知道这个函数是把字符串转化为
HEX整型变量的对于这个函数我十分感兴趣但起初是觉得这一定是现成的函数不用太在意一定可以在网上找到不过我错
了的确是翻了很久很久在网上也没有找到一个比较完整好用的函数于是分析了一下

先调用lstrlenA得到字符串的长度之后就进入循环读入一个字节比较该字节的ascii值 30h～39h就直接减去30h 即为0～9
如果是61h～66h就减去61h之后在加上0Ah 就是0Ah～0Fh 之后用这个值去乘以10h 分别乘以当前esi-1次即实现了进位
之后出乘法小循环把中间结果保存在局部变量里字符串指针+1 esi变量-1 再去循环知道最后esi为0 退出大循环

最后的结果保存在 EAX寄存器里……

好了大概经过我们都明白了这个程序就像是自己的了看哪里都知道原理呵呵但这还不是我们的最终目的嘻嘻

知道原理就要实现逆向高级语言都不怕难何况这种会编写的清晰的都告诉你API的程序呢

所以ASM写了自己的一个小工具对他的代码某些部分进行了优化

代码里引用了玩命大侠在《【成果6.1】软件保护壳技术专题 - 添加新节》一文中的代码稍作修改主要是不敢班门弄斧

代码中引用了罗云斌 @公用子程序部分：窗口部分将窗口移动到屏幕中间函数

[SIZE=2][COLOR=#0000ff].386[/SIZE]
[SIZE=2][COLOR=#0000ff].model [COLOR=#ff0000]flat, [COLOR=#ff0000]stdcall[/SIZE]
[SIZE=2][COLOR=#0000ff]option [COLOR=#ff0000]casemap:[COLOR=#ff0000]none[/SIZE]
 
[SIZE=2][COLOR=#008000];; ----------------------------------------[/SIZE]
[SIZE=2][COLOR=#008000];; header file and lib file[/SIZE]
[SIZE=2][COLOR=#008000];; ----------------------------------------[/SIZE]
[SIZE=2][COLOR=#0000ff]include kernel32.inc[/SIZE]
[SIZE=2][COLOR=#0000ff]include user32.inc[/SIZE]
[SIZE=2][COLOR=#0000ff]include comdlg32.inc[/SIZE]
[SIZE=2][COLOR=#0000ff]includelib kernel32.lib[/SIZE]
[SIZE=2][COLOR=#0000ff]includelib user32.lib[/SIZE]
[SIZE=2][COLOR=#0000ff]includelib comdlg32.lib[/SIZE]
[SIZE=2][COLOR=#0000ff]include windows.inc[/SIZE]
[SIZE=2]PEAlign [COLOR=#0000ff]proto dwTarNum : [COLOR=#ff0000]DWORD, dwAlignTo : [COLOR=#ff0000]DWORD[/SIZE]
[SIZE=2]AddSection [COLOR=#0000ff]proto pMem : LPVOID, [/SIZE]
[SIZE=2]                 pSectionName : LPVOID, [/SIZE]
[SIZE=2]                 dwSectionSize : [COLOR=#ff0000]DWORD[/SIZE]
[SIZE=2][COLOR=#008000];DLGproc proto dlghwnd:HWND,uMsg:UINT,wParam:WPARAM,lParam:LPARAM[/SIZE]
[SIZE=2][COLOR=#008000];_CenterWindow    proto    :DWORD        ;将窗口移动到屏幕中间 by 罗云彬@公用子程序部分：窗口部分[/SIZE]
[SIZE=2]APPEND_SIZE                     [COLOR=#ff0000]equ 2000h[/SIZE]
[SIZE=2][COLOR=#0000ff].data[/SIZE]
[SIZE=2]ofn OPENFILENAME <>[/SIZE]
[SIZE=2]lpstrFilter [COLOR=#ff0000]db [COLOR=#ff00ff]"eXe Files(*.eXe)",0[/SIZE]
[SIZE=2]lpstrFile [COLOR=#ff0000]db 255 dup(0)[/SIZE]
[SIZE=2]lpstrBAKFile [COLOR=#ff0000]db 255 dup(0)[/SIZE]
[SIZE=2]lpBAK [COLOR=#ff0000]db [COLOR=#ff00ff]".bak",0[/SIZE]
[SIZE=2]lpsectionName [COLOR=#ff0000]db 8 dup(0)[/SIZE]
[SIZE=2]lpsectionSize [COLOR=#ff0000]db 8 dup(0)[/SIZE]
 
[SIZE=2][COLOR=#008000];////////////////////////////////////////////////////////////////[/SIZE]
[SIZE=2][COLOR=#008000];以下变量定义摘自"玩命"大侠 【成果6.1】软件保护壳技术专题 - 添加新节[/SIZE]
[SIZE=2][COLOR=#008000];////////////////////////////////////////////////////////////////[/SIZE]
[SIZE=2]g_szErr                     [COLOR=#ff0000]db [COLOR=#ff00ff]"错误",0[/SIZE]
[SIZE=2]g_szDone                    [COLOR=#ff0000]db [COLOR=#ff00ff]"文件加密成功!",0[/SIZE]
[SIZE=2]g_szDoneCap                 [COLOR=#ff0000]db [COLOR=#ff00ff]"^_^",0[/SIZE]
[SIZE=2]g_szOpenFileFailed          [COLOR=#ff0000]db [COLOR=#ff00ff]"打不开文件",0[/SIZE]
[SIZE=2]g_szGetFileSizeFailed       [COLOR=#ff0000]db [COLOR=#ff00ff]"获取文件大小失败",0[/SIZE]
[SIZE=2]g_szCreateMapFailed         [COLOR=#ff0000]db [COLOR=#ff00ff]"创建文件映射失败",0[/SIZE]
[SIZE=2]g_szMapFileFailed           [COLOR=#ff0000]db [COLOR=#ff00ff]"映射文件到内存失败",0[/SIZE]
[SIZE=2]g_szInvalidPE               [COLOR=#ff0000]db [COLOR=#ff00ff]"无效的PE文件",0[/SIZE]
[SIZE=2]g_bError                [COLOR=#ff0000]db 0[/SIZE]
[SIZE=2]g_dwNewSectionSize      [COLOR=#ff0000]dd 0[/SIZE]
 
[SIZE=2][COLOR=#0000ff].code[/SIZE]
[SIZE=2][COLOR=#008000];////////////////////////////////////////////////////////////////[/SIZE]
[SIZE=2][COLOR=#008000];以下函数修改自"玩命"大侠 【成果6.1】软件保护壳技术专题 - 添加新节[/SIZE]
[SIZE=2][COLOR=#008000];http://bbs.pediy.com/showthread.php?p=467116[/SIZE]
[SIZE=2][COLOR=#008000];一文，稍作改动[/SIZE]
[SIZE=2][COLOR=#008000];////////////////////////////////////////////////////////////////[/SIZE]
[SIZE=2]CryptFile [COLOR=#ff0000]proc szFname : LPSTR,szSectionName:LPSTR,dwSectionSize:[COLOR=#ff0000]DWORD[/SIZE]
[SIZE=2]     [COLOR=#ff0000]LOCAL hFile : HANDLE[/SIZE]
[SIZE=2]     [COLOR=#ff0000]LOCAL hMap : HANDLE[/SIZE]
[SIZE=2]     [COLOR=#ff0000]LOCAL pMem : LPVOID[/SIZE]
[SIZE=2]     [COLOR=#ff0000]LOCAL dwOrigFileSize : [COLOR=#ff0000]DWORD[/SIZE]
[SIZE=2]     [COLOR=#ff0000]LOCAL dwNTHeaderAddr : [COLOR=#ff0000]DWORD[/SIZE]
 
[SIZE=2]     [COLOR=#008000];; init data[/SIZE]
[SIZE=2]     [COLOR=#0000ff]xor [COLOR=#808000]eax, [COLOR=#808000]eax[/SIZE]
[SIZE=2]     [COLOR=#0000ff]mov g_bError, [COLOR=#808000]al[/SIZE]
[SIZE=2]     [COLOR=#0000ff]mov [COLOR=#808000]eax, dwSectionSize[/SIZE]
[SIZE=2]     [COLOR=#0000ff]mov g_dwNewSectionSize, [COLOR=#808000]eax[/SIZE]
 
[SIZE=2]     [COLOR=#008000];; open file[/SIZE]
[SIZE=2]      [COLOR=#ff0000]invoke CreateFile, szFname,\[/SIZE]
[SIZE=2]                          GENERIC_WRITE + GENERIC_READ,\[/SIZE]
[SIZE=2]                          FILE_SHARE_WRITE + FILE_SHARE_READ,\[/SIZE]
[SIZE=2]                          NULL,\[/SIZE]
[SIZE=2]                          OPEN_EXISTING,\[/SIZE]
[SIZE=2]                          FILE_ATTRIBUTE_NORMAL,\[/SIZE]
[SIZE=2]                          0[/SIZE]
[SIZE=2]     [COLOR=#ff0000].IF [COLOR=#808000]eax == INVALID_HANDLE_VALUE[/SIZE]
[SIZE=2]         [COLOR=#0000ff]jmp OpenFileFailed                [/SIZE]
[SIZE=2]     [COLOR=#ff0000].ENDIF[/SIZE]
[SIZE=2]     [COLOR=#0000ff]mov hFile, [COLOR=#808000]eax [/SIZE]
[SIZE=2]     [COLOR=#ff0000]invoke GetFileSize, hFile, NULL[/SIZE]
[SIZE=2]    [COLOR=#ff0000].IF [COLOR=#808000]eax == 0[/SIZE]
[SIZE=2]        [COLOR=#ff0000]invoke CloseHandle, hFile  [/SIZE]
[SIZE=2]        [COLOR=#0000ff]jmp GetFileSizeFailed[/SIZE]
[SIZE=2]    [COLOR=#ff0000].ENDIF[/SIZE]
[SIZE=2]     [COLOR=#0000ff]mov dwOrigFileSize, [COLOR=#808000]eax   [/SIZE]
 
[SIZE=2]     [COLOR=#0000ff]add [COLOR=#808000]eax, APPEND_SIZE[/SIZE]
 
[SIZE=2]     [COLOR=#0000ff]xchg [COLOR=#808000]eax, [COLOR=#808000]ecx[/SIZE]
[SIZE=2]     [COLOR=#008000];; create memory map[/SIZE]
[SIZE=2]     [COLOR=#0000ff]xor [COLOR=#808000]ebx, [COLOR=#808000]ebx     [/SIZE]
[SIZE=2]     [COLOR=#ff0000]invoke CreateFileMapping, hFile, [COLOR=#808000]ebx, PAGE_READWRITE, [COLOR=#808000]ebx, [COLOR=#808000]ecx, [COLOR=#808000]ebx[/SIZE]
[SIZE=2]     [COLOR=#ff0000].IF [COLOR=#808000]eax == 0[/SIZE]
[SIZE=2]         [COLOR=#ff0000]invoke CloseHandle, hFile[/SIZE]
[SIZE=2]         [COLOR=#0000ff]jmp CreateMapFailed                [/SIZE]
[SIZE=2]     [COLOR=#ff0000].ENDIF[/SIZE]
[SIZE=2]     [COLOR=#0000ff]mov hMap, [COLOR=#808000]eax[/SIZE]
[SIZE=2]     [COLOR=#008000];; map file to memory[/SIZE]
[SIZE=2]     [COLOR=#ff0000]invoke MapViewOfFile, hMap,[/SIZE]
[SIZE=2]                           FILE_MAP_WRITE+FILE_MAP_READ+FILE_MAP_COPY, [/SIZE]
[SIZE=2]                           [COLOR=#808000]ebx, [COLOR=#808000]ebx, [COLOR=#808000]ebx[/SIZE]
[SIZE=2]     [COLOR=#ff0000].IF [COLOR=#808000]eax == 0[/SIZE]
[SIZE=2]         [COLOR=#ff0000]invoke CloseHandle, hMap[/SIZE]
[SIZE=2]         [COLOR=#ff0000]invoke CloseHandle, hFile[/SIZE]
[SIZE=2]         [COLOR=#0000ff]jmp MapFileFailed[/SIZE]
[SIZE=2]     [COLOR=#ff0000].ENDIF[/SIZE]
[SIZE=2]     [COLOR=#0000ff]mov pMem, [COLOR=#808000]eax                               [/SIZE]
[SIZE=2]     [COLOR=#008000];; check it's PE file or not ?[/SIZE]
[SIZE=2]     [COLOR=#0000ff]xchg [COLOR=#808000]eax, [COLOR=#808000]esi[/SIZE]
[SIZE=2]     assume [COLOR=#808000]esi : [COLOR=#ff0000]ptr IMAGE_DOS_HEADER[/SIZE]
[SIZE=2]     [COLOR=#ff0000].IF [[COLOR=#808000]esi].e_magic != 'ZM'[/SIZE]
[SIZE=2]         [COLOR=#ff0000]invoke UnmapViewOfFile, pMem[/SIZE]
[SIZE=2]         [COLOR=#ff0000]invoke CloseHandle, hMap[/SIZE]
[SIZE=2]         [COLOR=#ff0000]invoke CloseHandle, hFile[/SIZE]
[SIZE=2]         [COLOR=#0000ff]jmp InvalidPE        [/SIZE]
[SIZE=2]     [COLOR=#ff0000].ENDIF       [/SIZE]
[SIZE=2]     [COLOR=#0000ff]add [COLOR=#808000]esi, [[COLOR=#808000]esi].e_lfanew[/SIZE]
[SIZE=2]     assume [COLOR=#808000]esi : [COLOR=#ff0000]ptr IMAGE_NT_HEADERS   [/SIZE]
[SIZE=2]     [COLOR=#ff0000].IF [COLOR=#ff0000]word [COLOR=#ff0000]ptr [[COLOR=#808000]esi].Signature != 'EP'[/SIZE]
[SIZE=2]         [COLOR=#ff0000]invoke UnmapViewOfFile, pMem[/SIZE]
[SIZE=2]         [COLOR=#ff0000]invoke CloseHandle, hMap[/SIZE]
[SIZE=2]         [COLOR=#ff0000]invoke CloseHandle, hFile[/SIZE]
[SIZE=2]         [COLOR=#0000ff]jmp InvalidPE        [/SIZE]
[SIZE=2]     [COLOR=#ff0000].ENDIF[/SIZE]
[SIZE=2]     [COLOR=#0000ff]mov dwNTHeaderAddr, [COLOR=#808000]esi[/SIZE]
 
 
[SIZE=2]    [COLOR=#ff0000]invoke AddSection, pMem,szSectionName, g_dwNewSectionSize[/SIZE]
[SIZE=2]    [COLOR=#0000ff]push [COLOR=#808000]eax[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]esi, dwNTHeaderAddr[/SIZE]
[SIZE=2]    assume [COLOR=#808000]esi : [COLOR=#ff0000]ptr IMAGE_NT_HEADERS[/SIZE]
 
[SIZE=2] LogicShellExit:[/SIZE]
[SIZE=2]     [COLOR=#008000];; close handle & write it[/SIZE]
[SIZE=2]     [COLOR=#ff0000]invoke UnmapViewOfFile, pMem[/SIZE]
[SIZE=2]     [COLOR=#ff0000]invoke CloseHandle, hMap[/SIZE]
[SIZE=2]     [COLOR=#ff0000]invoke CloseHandle, hFile[/SIZE]
[SIZE=2]     [COLOR=#ff0000].IF g_bError == 0[/SIZE]
[SIZE=2]         [COLOR=#008000];; show success message  [/SIZE]
[SIZE=2]         [COLOR=#ff0000]invoke MessageBox, NULL, [COLOR=#ff0000]offset g_szDone, [COLOR=#ff0000]offset g_szDoneCap, MB_ICONINFORMATION[/SIZE]
[SIZE=2]     [COLOR=#ff0000].ENDIF        [/SIZE]
[SIZE=2]     [COLOR=#0000ff]ret[/SIZE]
[SIZE=2][COLOR=#008000];; ----- Show error message ----- [/SIZE]
[SIZE=2]OpenFileFailed:[/SIZE]
[SIZE=2]     [COLOR=#0000ff]lea [COLOR=#808000]eax, g_szOpenFileFailed[/SIZE]
[SIZE=2]     [COLOR=#0000ff]jmp ShowErr[/SIZE]
[SIZE=2]GetFileSizeFailed:[/SIZE]
[SIZE=2]     [COLOR=#0000ff]lea [COLOR=#808000]eax, g_szGetFileSizeFailed[/SIZE]
[SIZE=2]     [COLOR=#0000ff]jmp ShowErr    [/SIZE]
[SIZE=2]CreateMapFailed:[/SIZE]
[SIZE=2]     [COLOR=#0000ff]lea [COLOR=#808000]eax, g_szCreateMapFailed[/SIZE]
[SIZE=2]     [COLOR=#0000ff]jmp ShowErr[/SIZE]
[SIZE=2]MapFileFailed:[/SIZE]
[SIZE=2]     [COLOR=#0000ff]lea [COLOR=#808000]eax, g_szMapFileFailed[/SIZE]
[SIZE=2]     [COLOR=#0000ff]jmp ShowErr        [/SIZE]
[SIZE=2]InvalidPE:          [/SIZE]
[SIZE=2]     [COLOR=#0000ff]lea [COLOR=#808000]eax, g_szInvalidPE[/SIZE]
[SIZE=2]     [COLOR=#0000ff]jmp ShowErr   [/SIZE]
[SIZE=2]ShowErr:[/SIZE]
[SIZE=2]     [COLOR=#ff0000]invoke MessageBox, NULL, [COLOR=#808000]eax, [COLOR=#ff0000]offset g_szErr, MB_ICONERROR[/SIZE]
[SIZE=2]     [COLOR=#0000ff]mov [COLOR=#808000]al, 1[/SIZE]
[SIZE=2]     [COLOR=#0000ff]mov g_bError, [COLOR=#808000]al[/SIZE]
[SIZE=2]     [COLOR=#0000ff]jmp LogicShellExit[/SIZE]
 
[SIZE=2]CryptFile [COLOR=#ff0000]endp [/SIZE]
 
[SIZE=2]AddSection [COLOR=#ff0000]proc [COLOR=#ff0000]uses [COLOR=#808000]ebx [COLOR=#808000]ecx [COLOR=#808000]edx [COLOR=#808000]esi [COLOR=#808000]edi, pMem : LPVOID,[/SIZE]
[SIZE=2]                                          pSectionName : LPVOID,[/SIZE]
[SIZE=2]                                          dwSectionSize : [COLOR=#ff0000]DWORD[/SIZE]
[SIZE=2][COLOR=#008000];; add a new section[/SIZE]
[SIZE=2][COLOR=#008000];; ret: eax =  new section table file offset[/SIZE]
[SIZE=2]    [COLOR=#ff0000]LOCAL dwNTHeader : LPVOID[/SIZE]
[SIZE=2]    [COLOR=#ff0000]LOCAL dwLastSecTbl : LPVOID    [/SIZE]
[SIZE=2]    [COLOR=#ff0000]LOCAL dwFileAlig : [COLOR=#ff0000]DWORD[/SIZE]
[SIZE=2]    [COLOR=#ff0000]LOCAL dwSecAlig : [COLOR=#ff0000]DWORD[/SIZE]
 
[SIZE=2]    [COLOR=#008000];; move to section table[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]esi, pMem[/SIZE]
 
[SIZE=2]    [COLOR=#008000];; assume esi : ptr IMAGE_DOS_HEADER[/SIZE]
[SIZE=2]    [COLOR=#008000];; add esi, dword ptr [esi].e_lfanew[/SIZE]
[SIZE=2]    [COLOR=#0000ff]add [COLOR=#808000]esi, [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]esi+3ch][/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov dwNTHeader, [COLOR=#808000]esi  [/SIZE]
[SIZE=2]    assume [COLOR=#808000]esi : [COLOR=#ff0000]ptr IMAGE_NT_HEADERS[/SIZE]
[SIZE=2]    [COLOR=#008000];; update the number of section[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]cx, [COLOR=#ff0000]word [COLOR=#ff0000]ptr [[COLOR=#808000]esi].FileHeader.NumberOfSections[/SIZE]
[SIZE=2]    [COLOR=#0000ff]movzx [COLOR=#808000]ecx, [COLOR=#808000]cx[/SIZE]
 
[SIZE=2]    [COLOR=#0000ff]inc [COLOR=#ff0000]word [COLOR=#ff0000]ptr [[COLOR=#808000]esi].FileHeader.NumberOfSections[/SIZE]
[SIZE=2]    [COLOR=#0000ff]push [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]esi].OptionalHeader.FileAlignment[/SIZE]
[SIZE=2]    [COLOR=#0000ff]pop dwFileAlig[/SIZE]
[SIZE=2]    [COLOR=#0000ff]push [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]esi].OptionalHeader.SectionAlignment[/SIZE]
[SIZE=2]    [COLOR=#0000ff]pop dwSecAlig        [/SIZE]
[SIZE=2]    [COLOR=#008000];; move esi point to section table[/SIZE]
 
[SIZE=2]    [COLOR=#0000ff]add [COLOR=#808000]esi, sizeof IMAGE_NT_HEADERS[/SIZE]
[SIZE=2]    [COLOR=#008000];; store the last section table[/SIZE]
 
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]eax, sizeof IMAGE_SECTION_HEADER[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]ebx, [COLOR=#808000]ecx[/SIZE]
[SIZE=2]    [COLOR=#0000ff]imul [COLOR=#808000]ebx[/SIZE]
 
[SIZE=2]    [COLOR=#0000ff]add [COLOR=#808000]esi, [COLOR=#808000]eax                            [COLOR=#008000]; esi = the end of orig last section fva[/SIZE]
[SIZE=2]    [COLOR=#0000ff]push [COLOR=#808000]esi[/SIZE]
 
[SIZE=2]    [COLOR=#0000ff]sub [COLOR=#808000]esi, sizeof IMAGE_SECTION_HEADER    [COLOR=#008000]; esi = the orig last section fva[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov dwLastSecTbl, [COLOR=#808000]esi[/SIZE]
[SIZE=2]    [COLOR=#0000ff]pop [COLOR=#808000]esi[/SIZE]
[SIZE=2]    [COLOR=#008000];; set new section table[/SIZE]
 
[SIZE=2]    assume [COLOR=#808000]esi : [COLOR=#ff0000]ptr IMAGE_SECTION_HEADER[/SIZE]
[SIZE=2]    [COLOR=#008000];; set section name[/SIZE]
[SIZE=2]    [COLOR=#0000ff]push [COLOR=#808000]esi[/SIZE]
[SIZE=2]    [COLOR=#0000ff]lea [COLOR=#808000]edi, [[COLOR=#808000]esi].Name1[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]esi, pSectionName[/SIZE]
[SIZE=2]CopySectionNameLoop:   [/SIZE]
[SIZE=2]    [COLOR=#0000ff]lodsb[/SIZE]
[SIZE=2]    [COLOR=#0000ff]test [COLOR=#808000]al, [COLOR=#808000]al[/SIZE]
[SIZE=2]    [COLOR=#0000ff]jz EndCopySectionNameLoop[/SIZE]
[SIZE=2]    [COLOR=#0000ff]stosb[/SIZE]
[SIZE=2]    [COLOR=#0000ff]jmp CopySectionNameLoop[/SIZE]
[SIZE=2]EndCopySectionNameLoop:  [/SIZE]
[SIZE=2]    [COLOR=#0000ff]pop [COLOR=#808000]esi  [/SIZE]
 
[SIZE=2]    [COLOR=#0000ff]push 0E00000E0h[/SIZE]
[SIZE=2]    [COLOR=#0000ff]pop [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]esi].Characteristics[/SIZE]
 
[SIZE=2]    [COLOR=#0000ff]push dwSectionSize[/SIZE]
[SIZE=2]    [COLOR=#0000ff]pop [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]esi].Misc.VirtualSize[/SIZE]
 
[SIZE=2]    [COLOR=#ff0000]invoke PEAlign, dwSectionSize, dwFileAlig[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]esi].SizeOfRawData, [COLOR=#808000]eax[/SIZE]
 
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]eax, dwLastSecTbl                       [COLOR=#008000]; eax = orig last section table fva[/SIZE]
[SIZE=2]    assume [COLOR=#808000]eax : [COLOR=#ff0000]ptr IMAGE_SECTION_HEADER[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]ecx, [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]eax].VirtualAddress[/SIZE]
[SIZE=2]    [COLOR=#0000ff]add [COLOR=#808000]ecx, [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]eax].Misc.VirtualSize        [COLOR=#008000]; ecx = new section rva[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]ebx, [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]eax].PointerToRawData[/SIZE]
[SIZE=2]    [COLOR=#0000ff]add [COLOR=#808000]ebx, [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]eax].SizeOfRawData           [COLOR=#008000]; ebx = new section fva[/SIZE]
[SIZE=2]    [COLOR=#ff0000]invoke PEAlign, [COLOR=#808000]ecx, dwSecAlig[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]esi].VirtualAddress, [COLOR=#808000]eax[/SIZE]
[SIZE=2]    [COLOR=#008000];; set section pointertorawdata[/SIZE]
[SIZE=2]    [COLOR=#ff0000]invoke PEAlign, [COLOR=#808000]ebx, dwFileAlig[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]esi].PointerToRawData, [COLOR=#808000]eax[/SIZE]
 
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]eax, [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]esi].VirtualAddress[/SIZE]
[SIZE=2]    [COLOR=#0000ff]add [COLOR=#808000]eax, [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]esi].Misc.VirtualSize[/SIZE]
[SIZE=2]    [COLOR=#ff0000]invoke PEAlign, [COLOR=#808000]eax, dwSecAlig[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]edx, dwNTHeader[/SIZE]
[SIZE=2]    assume [COLOR=#808000]edx : [COLOR=#ff0000]ptr IMAGE_NT_HEADERS[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]edx].OptionalHeader.SizeOfImage, [COLOR=#808000]eax[/SIZE]
[SIZE=2]    [COLOR=#0000ff]push [COLOR=#ff0000]dword [COLOR=#ff0000]ptr [[COLOR=#808000]esi].PointerToRawData[/SIZE]
[SIZE=2]    [COLOR=#0000ff]pop [COLOR=#808000]edi[/SIZE]
[SIZE=2]    [COLOR=#0000ff]add [COLOR=#808000]edi, pMem[/SIZE]
[SIZE=2]    [COLOR=#008000];; clear the new sec[/SIZE]
 
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]ecx, dwSectionSize[/SIZE]
[SIZE=2]    [COLOR=#0000ff]xor [COLOR=#808000]eax, [COLOR=#808000]eax[/SIZE]
[SIZE=2]    [COLOR=#0000ff]cld[/SIZE]
[SIZE=2]    [COLOR=#0000ff]rep [COLOR=#0000ff]stosb[/SIZE]
 
 
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]eax, [COLOR=#808000]esi[/SIZE]
[SIZE=2]    assume [COLOR=#808000]esi : nothing[/SIZE]
[SIZE=2]    assume [COLOR=#808000]eax : nothing[/SIZE]
[SIZE=2]    assume [COLOR=#808000]edx : nothing[/SIZE]
[SIZE=2]    [COLOR=#0000ff]ret[/SIZE]
[SIZE=2]AddSection [COLOR=#ff0000]endp[/SIZE]
 
[SIZE=2]PEAlign [COLOR=#ff0000]proc [COLOR=#ff0000]uses [COLOR=#808000]ecx [COLOR=#808000]edx, dwTarNum : [COLOR=#ff0000]DWORD, dwAlignTo : [COLOR=#ff0000]DWORD[/SIZE]
[SIZE=2][COLOR=#008000];; returns aligned value    [/SIZE]
[SIZE=2]    [COLOR=#008000];; Algorithms:[/SIZE]
[SIZE=2]    [COLOR=#008000];; $1 = dwTarNum / dwAlignTo[/SIZE]
[SIZE=2]    [COLOR=#008000];; if remain != 0[/SIZE]
[SIZE=2]    [COLOR=#008000];; $r = $1 + 1 * dwAlignTo[/SIZE]
[SIZE=2]    [COLOR=#008000];; return $r[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]ecx, dwAlignTo[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]eax, dwTarNum[/SIZE]
[SIZE=2]    [COLOR=#0000ff]xor [COLOR=#808000]edx, [COLOR=#808000]edx[/SIZE]
[SIZE=2]    [COLOR=#0000ff]div [COLOR=#808000]ecx[/SIZE]
[SIZE=2]    [COLOR=#0000ff]cmp [COLOR=#808000]edx, 0[/SIZE]
[SIZE=2]    [COLOR=#0000ff]jz AlreadyAligned[/SIZE]
[SIZE=2]    [COLOR=#0000ff]inc [COLOR=#808000]eax[/SIZE]
[SIZE=2]AlreadyAligned:[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mul [COLOR=#808000]ecx      [/SIZE]
[SIZE=2]    [COLOR=#0000ff]ret[/SIZE]
 
[SIZE=2]PEAlign [COLOR=#ff0000]endp   [/SIZE]
 
[SIZE=2][COLOR=#008000];////////////////////////////////////////////////////////////////////////[/SIZE]
[SIZE=2][COLOR=#008000];引用代码结束[/SIZE]
[SIZE=2][COLOR=#008000];////////////////////////////////////////////////////////////////////////[/SIZE]
[SIZE=2]_CenterWindow    [COLOR=#ff0000]proc    hWnd:[COLOR=#ff0000]DWORD[/SIZE]
[SIZE=2]        [COLOR=#ff0000]local    @stRectDeskTop:RECT,@stRectWin:RECT[/SIZE]
[SIZE=2]        [COLOR=#ff0000]local    @dwWidth:[COLOR=#ff0000]DWORD,@dwHeight:[COLOR=#ff0000]DWORD[/SIZE]
 
[SIZE=2]        [COLOR=#ff0000]invoke    GetWindowRect,hWnd,[COLOR=#ff0000]addr @stRectWin[/SIZE]
[SIZE=2]        [COLOR=#ff0000]invoke    GetDesktopWindow[/SIZE]
[SIZE=2]        [COLOR=#0000ff]mov    [COLOR=#808000]ebx,[COLOR=#808000]eax[/SIZE]
[SIZE=2]        [COLOR=#ff0000]invoke    GetWindowRect,[COLOR=#808000]ebx,[COLOR=#ff0000]addr @stRectDeskTop[/SIZE]
 
[SIZE=2]        [COLOR=#0000ff]mov    [COLOR=#808000]eax,@stRectWin.bottom[/SIZE]
[SIZE=2]        [COLOR=#0000ff]sub    [COLOR=#808000]eax,@stRectWin.top[/SIZE]
[SIZE=2]        [COLOR=#0000ff]mov    @dwHeight,[COLOR=#808000]eax[/SIZE]
[SIZE=2]        [COLOR=#0000ff]mov    [COLOR=#808000]eax,@stRectWin.right[/SIZE]
[SIZE=2]        [COLOR=#0000ff]sub    [COLOR=#808000]eax,@stRectWin.left[/SIZE]
[SIZE=2]        [COLOR=#0000ff]mov    @dwWidth,[COLOR=#808000]eax[/SIZE]
 
[SIZE=2]        [COLOR=#0000ff]mov    [COLOR=#808000]ebx,@stRectDeskTop.bottom[/SIZE]
[SIZE=2]        [COLOR=#0000ff]sub    [COLOR=#808000]ebx,@dwHeight[/SIZE]
[SIZE=2]        [COLOR=#0000ff]shr    [COLOR=#808000]ebx,1[/SIZE]
[SIZE=2]        [COLOR=#0000ff]mov    [COLOR=#808000]ecx,@stRectDeskTop.right[/SIZE]
[SIZE=2]        [COLOR=#0000ff]sub    [COLOR=#808000]ecx,@dwWidth[/SIZE]
[SIZE=2]        [COLOR=#0000ff]shr    [COLOR=#808000]ecx,1[/SIZE]
 
[SIZE=2]        [COLOR=#ff0000]invoke    MoveWindow,hWnd,[COLOR=#808000]ecx,[COLOR=#808000]ebx,@dwWidth,@dwHeight,[COLOR=#0000ff]FALSE[/SIZE]
[SIZE=2]        [COLOR=#0000ff]ret[/SIZE]
 
[SIZE=2]_CenterWindow    [COLOR=#ff0000]endp[/SIZE]
 
[SIZE=2]LpstrToHex [COLOR=#ff0000]proc [COLOR=#ff0000]uses [COLOR=#808000]esi [COLOR=#808000]edi [COLOR=#808000]ecx [COLOR=#808000]edx [COLOR=#808000]ebx, lpstr:LPSTR[/SIZE]
 
[SIZE=2]    [COLOR=#ff0000]LOCAL dwM:[COLOR=#ff0000]DWORD[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]ebx,10h[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]edi,lpstr[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov dwM,0[/SIZE]
[SIZE=2]    [COLOR=#ff0000]invoke lstrlen,lpstr[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]esi,[COLOR=#808000]eax[/SIZE]
[SIZE=2]looop3:  [/SIZE]
[SIZE=2]        [COLOR=#ff0000].if [COLOR=#808000]esi>0[/SIZE]
[SIZE=2]        [COLOR=#0000ff]mov [COLOR=#808000]al,[COLOR=#ff0000]byte [COLOR=#ff0000]ptr [[COLOR=#808000]edi][/SIZE]
[SIZE=2]                [COLOR=#ff0000].if [COLOR=#808000]al>=30h[/SIZE]
[SIZE=2]              [COLOR=#ff0000].if [COLOR=#808000]al<=39h[/SIZE]
[SIZE=2]            [COLOR=#0000ff]sub [COLOR=#808000]al,30h[/SIZE]
[SIZE=2]                        [COLOR=#0000ff]jmp looop[/SIZE]
[SIZE=2]              [COLOR=#ff0000].elseif [COLOR=#808000]al>=61h[/SIZE]
[SIZE=2]                   [COLOR=#ff0000].if [COLOR=#808000]al<=66h[/SIZE]
[SIZE=2]                [COLOR=#0000ff]sub [COLOR=#808000]al,61h[/SIZE]
[SIZE=2]                [COLOR=#0000ff]add [COLOR=#808000]al,0ah[/SIZE]
[SIZE=2]                [COLOR=#0000ff]jmp looop[/SIZE]
 
[SIZE=2]                   [COLOR=#ff0000].elseif [COLOR=#808000]al>=41h[/SIZE]
[SIZE=2]                        [COLOR=#ff0000].if [COLOR=#808000]al<=46h[/SIZE]
[SIZE=2]                    [COLOR=#0000ff]sub [COLOR=#808000]al,41h[/SIZE]
[SIZE=2]                    [COLOR=#0000ff]add [COLOR=#808000]al,0ah[/SIZE]
[SIZE=2]                    [COLOR=#0000ff]jmp looop[/SIZE]
[SIZE=2]                    [COLOR=#ff0000].endif[/SIZE]
[SIZE=2]                   [COLOR=#ff0000].endif[/SIZE]
[SIZE=2]              [COLOR=#ff0000].endif[/SIZE]
[SIZE=2]        looop:  [/SIZE]
[SIZE=2]                [COLOR=#0000ff]movzx [COLOR=#808000]eax,[COLOR=#808000]al[/SIZE]
[SIZE=2]            [COLOR=#0000ff]mov [COLOR=#808000]ecx,[COLOR=#808000]esi[/SIZE]
[SIZE=2]            [COLOR=#0000ff]dec [COLOR=#808000]ecx[/SIZE]
[SIZE=2]            looop2: [/SIZE]
[SIZE=2]                    [COLOR=#ff0000].if [COLOR=#808000]ecx>0[/SIZE]
[SIZE=2]                [COLOR=#0000ff]mul [COLOR=#808000]ebx[/SIZE]
[SIZE=2]                [COLOR=#0000ff]dec [COLOR=#808000]ecx[/SIZE]
[SIZE=2]                [COLOR=#0000ff]jmp looop2[/SIZE]
[SIZE=2]            [COLOR=#ff0000].endif[/SIZE]
[SIZE=2]            [COLOR=#0000ff]add dwM,[COLOR=#808000]eax[/SIZE]
[SIZE=2]            [COLOR=#0000ff]inc [COLOR=#808000]edi[/SIZE]
[SIZE=2]            [COLOR=#0000ff]dec [COLOR=#808000]esi[/SIZE]
[SIZE=2]            [COLOR=#0000ff]jmp looop3[/SIZE]
[SIZE=2]        [COLOR=#ff0000].endif[/SIZE]
[SIZE=2]    [COLOR=#ff0000].endif[/SIZE]
[SIZE=2]    [COLOR=#0000ff]mov [COLOR=#808000]eax,dwM[/SIZE]
[SIZE=2]    [COLOR=#0000ff]ret[/SIZE]
 
[SIZE=2]LpstrToHex [COLOR=#ff0000]endp[/SIZE]
[SIZE=2]DLGproc [COLOR=#ff0000]proc dlghwnd:HWND,uMsg:UINT,wParam:WPARAM,lParam:LPARAM[/SIZE]
[SIZE=2]        [COLOR=#0000ff]mov    [COLOR=#808000]eax,uMsg[/SIZE]
[SIZE=2]        [COLOR=#ff0000].if    [COLOR=#808000]eax == WM_CLOSE[/SIZE]
[SIZE=2]            [COLOR=#ff0000]invoke    EndDialog,dlghwnd,NULL[/SIZE]
[SIZE=2][COLOR=#008000];********************************************************************[/SIZE]
[SIZE=2]        [COLOR=#ff0000].elseif    [COLOR=#808000]eax == WM_INITDIALOG[/SIZE]
[SIZE=2]            [COLOR=#ff0000]invoke    _CenterWindow,dlghwnd[/SIZE]
[SIZE=2][COLOR=#008000];********************************************************************[/SIZE]
[SIZE=2]        [COLOR=#ff0000].elseif    [COLOR=#808000]eax == WM_COMMAND[/SIZE]
[SIZE=2]            [COLOR=#0000ff]mov    [COLOR=#808000]eax,wParam[/SIZE]
[SIZE=2]            [COLOR=#0000ff]movzx    [COLOR=#808000]eax,[COLOR=#808000]ax[/SIZE]
[SIZE=2]            [COLOR=#ff0000].if    [COLOR=#808000]eax ==    1001[/SIZE]
[SIZE=2]                      [COLOR=#0000ff]mov ofn.lStructSize,sizeof ofn[/SIZE]
[SIZE=2]                                  [COLOR=#0000ff]mov [COLOR=#808000]eax,[COLOR=#ff0000]offset lpstrFilter  [COLOR=#008000];初始化ofn结构[/SIZE]
[SIZE=2]                  [COLOR=#0000ff]mov ofn.lpstrFilter,[COLOR=#808000]eax[/SIZE]
[SIZE=2]                  [COLOR=#0000ff]mov [COLOR=#808000]eax,[COLOR=#ff0000]offset lpstrFile[/SIZE]
[SIZE=2]                  [COLOR=#0000ff]mov ofn.lpstrFile,[COLOR=#808000]eax[/SIZE]
[SIZE=2]                  [COLOR=#0000ff]mov ofn.nMaxFile,sizeof lpstrFile[/SIZE]
[SIZE=2]                  [COLOR=#0000ff]mov ofn.Flags,OFN_FILEMUSTEXIST [COLOR=#0000ff]or OFN_PATHMUSTEXIST[/SIZE]
[SIZE=2]                [COLOR=#ff0000]invoke GetOpenFileName,[COLOR=#ff0000]addr ofn[/SIZE]
[SIZE=2]                [COLOR=#ff0000].if [COLOR=#808000]eax==1[/SIZE]
[SIZE=2]                    [COLOR=#ff0000]invoke SetDlgItemText,dlghwnd,1003,ofn.lpstrFile[/SIZE]
[SIZE=2]                [COLOR=#ff0000].endif[/SIZE]
[SIZE=2]            [COLOR=#ff0000].elseif    [COLOR=#808000]eax==1008[/SIZE]
[SIZE=2]                      [COLOR=#ff0000]invoke IsDlgButtonChecked,dlghwnd,1002[/SIZE]
[SIZE=2]                      [COLOR=#ff0000].if [COLOR=#808000]eax==1[/SIZE]
[SIZE=2]                          [COLOR=#ff0000]invoke lstrcpy,[COLOR=#ff0000]offset lpstrBAKFile,[COLOR=#ff0000]offset lpstrFile[/SIZE]
[SIZE=2]                          [COLOR=#ff0000]invoke lstrcat,[COLOR=#ff0000]offset lpstrBAKFile,[COLOR=#ff0000]offset lpBAK[/SIZE]
[SIZE=2]                          [COLOR=#ff0000]invoke CopyFile,[COLOR=#ff0000]offset lpstrFile,[COLOR=#ff0000]offset lpstrBAKFile,0[/SIZE]
[SIZE=2]                      [COLOR=#ff0000].endif[/SIZE]
[SIZE=2]                  [COLOR=#ff0000]invoke GetDlgItemText,dlghwnd,1003,[COLOR=#ff0000]offset lpstrFile,255[/SIZE]
[SIZE=2]                  [COLOR=#ff0000]invoke GetDlgItemText,dlghwnd,1005,[COLOR=#ff0000]offset lpsectionName,8[/SIZE]
[SIZE=2]                  [COLOR=#ff0000]invoke GetDlgItemText,dlghwnd,1007,[COLOR=#ff0000]offset lpsectionSize,8[/SIZE]
[SIZE=2]                  [COLOR=#ff0000]invoke LpstrToHex,[COLOR=#ff0000]offset lpsectionSize[/SIZE]
[SIZE=2]                  [COLOR=#ff0000]invoke CryptFile,[COLOR=#ff0000]offset lpstrFile,[COLOR=#ff0000]offset lpsectionName,[COLOR=#808000]eax[/SIZE]
[SIZE=2]            [COLOR=#ff0000].endif[/SIZE]
[SIZE=2][COLOR=#008000];********************************************************************[/SIZE]
[SIZE=2][COLOR=#008000];    注意：对话框的消息处理后，要返回 TRUE,对没有处理的消息[/SIZE]
[SIZE=2][COLOR=#008000];    要返回 FALSE[/SIZE]
[SIZE=2][COLOR=#008000];********************************************************************[/SIZE]
[SIZE=2]        [COLOR=#ff0000].else[/SIZE]
[SIZE=2]            [COLOR=#0000ff]mov    [COLOR=#808000]eax,[COLOR=#0000ff]FALSE[/SIZE]
[SIZE=2]            [COLOR=#0000ff]ret[/SIZE]
[SIZE=2]        [COLOR=#ff0000].endif[/SIZE]
[SIZE=2]        [COLOR=#0000ff]mov    [COLOR=#808000]eax,[COLOR=#0000ff]TRUE[/SIZE]
[SIZE=2]        [COLOR=#0000ff]ret[/SIZE]
 
[SIZE=2]DLGproc [COLOR=#ff0000]endp[/SIZE]
[SIZE=2]start:[/SIZE]
[SIZE=2][COLOR=#ff0000]invoke GetModuleHandle,0[/SIZE]
[SIZE=2][COLOR=#ff0000]invoke DialogBoxParam,[COLOR=#808000]eax,1000,0,[COLOR=#ff0000]addr DLGproc,0[/SIZE]
[SIZE=2][COLOR=#ff0000]invoke ExitProcess,0[/SIZE]
[SIZE=2][COLOR=#0000ff]end start[/SIZE]

附上资源脚本

#define IDD_DLG1 1000
#define IDC_BTN1 1001
#define IDC_CHK1 1002
#define IDC_STC1 1003
#define IDC_STC2 1004
#define IDC_EDT1 1005
#define IDC_STC3 1006
#define IDC_EDT2 1007
#define IDC_BTN2 1008
#define IDR_VERSION 1
IDD_DLG1 DIALOGEX 6,6,99,108
CAPTION "SCTaDD_BY_eASYSCt"
FONT 8,"MS Sans Serif",0,0
STYLE 0x10CA0000
BEGIN
  CONTROL "打开文件",IDC_BTN1,"Button",0x50010000,4,1,92,15
  CONTROL "备份源文件",IDC_CHK1,"Button",0x50010003,4,20,92,15
  CONTROL "",IDC_STC1,"Static",0x50000000,2,40,94,13
  CONTROL "新区段名",IDC_STC2,"Static",0x50000000,2,60,36,9
  CONTROL "",IDC_EDT1,"Edit",0x50010000,46,57,50,15,0x00000200
  CONTROL "新区段大小",IDC_STC3,"Static",0x50000000,2,77,42,9
  CONTROL "",IDC_EDT2,"Edit",0x50010000,46,73,50,15,0x00000200
  CONTROL "增加区段",IDC_BTN2,"Button",0x50010000,4,90,92,13
END
IDR_VERSION VERSIONINFO
FILEVERSION 1,0,0,0
PRODUCTVERSION 1,0,0,0
FILEOS 0x00000004
FILETYPE 0x00000000
BEGIN
  BLOCK "StringFileInfo"
  BEGIN
    BLOCK "FFFF0000"
    BEGIN
      VALUE "FileVersion", "1.0.0.0\0"
      VALUE "ProductVersion", "1.0.0.0\0"
      VALUE "CompanyName", "hIMcrACk\0"
    END
  END
  BLOCK "VarFileInfo"
  BEGIN
    VALUE "Translation", 0xFFFF, 0x0000
  END
END

玩命大侠的代码在http://bbs.pediy.com/showthread.php?p=467116有详细注释的像我一样的小菜虫可以去阅读~

其中函数LpstrToHex为自己优化后的字符串转16进制整型变量的函数算法上不算高明结构上不算美观不过能够达到效用
有需要的朋友可以拿去使用~~

期待大牛们逆出效率更高结构更漂亮的函数以供收藏……

天快亮了就不多写了最后把工具上传喜欢就拿去用~

感谢你耐心的看到这里为能忍受菜菜的笔记所感谢~

【经验总结】
PE文件结构基础 asm的练习细心coding 耐心debuging是最大收获

tHAT is ALl

THX!!!!

2008年11月23日 6:16:55

[2023春季班]《安卓高级研修班(网课)》月薪两万班招生中～

#调试逆向

上传的附件：

SCTaDD.rar （2.11kb，222次下载）

收藏・15

点赞・0

打赏

最新回复 (7)
sdfcfy 雪币： 204 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 231 粉丝 0 关注私信	sdfcfy 2008-11-23 07:30 2 楼 0 好文，学习了
快雪时晴雪币： 326 活跃值： (15) 能力值： ( LV9，RANK：170 ) 在线值：发帖 34 回帖 2278 粉丝 1 关注私信	快雪时晴 4 2008-11-23 16:47 3 楼 0 TAG:PE SECTION 区段添加 ZEROADD LORDPE 我对PE的学习一直很怵
yxhxiaoqi 雪币： 201 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 9 回帖 95 粉丝 0 关注私信	yxhxiaoqi 1 2008-11-23 19:12 4 楼 0 好文章往都很长！
newjueqi 雪币： 202 活跃值： (25) 能力值： ( LV9，RANK：290 ) 在线值：发帖 22 回帖 392 粉丝 2 关注私信	newjueqi 7 2008-11-23 20:14 5 楼 0 太长太暴力了
himcrack 雪币： 221 活跃值： (11) 能力值： ( LV9，RANK：250 ) 在线值：发帖 8 回帖 194 粉丝 0 关注私信	himcrack 6 2008-11-24 22:59 6 楼 0 [QUOTE=;]...[/QUOTE] 我也是最近才认真学习PE格式的觉得挺有趣的希望高手们多多指点… BTW: .if后的条件怎么复合？
fnzhangyao 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 44 粉丝 0 关注私信	fnzhangyao 2008-11-25 10:25 7 楼 0 [QUOTE=;]...[/QUOTE] 的确是精华。膜拜。
dxiaolin 雪币： 202 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 45 粉丝 0 关注私信	dxiaolin 2009-2-18 13:23 8 楼 0 学习，谢谢分享，我是菜鸟一个，还不是很懂我会努力的
	游客登录 \| 注册方可回帖　回帖　表情雪币赚取及消费高级回复

himcrack

发帖

194

回帖

250

RANK

关注

私信

他的文章

[原创]小程序antiOllyDBG脱壳&&简单分析

[原创]VMCraCk的双重爆破&&VM简要分析

[原创]TTP106Demo最小保护UnPaCk

[原创]理解VM 一个CraCkMe的VM简单分析

[原创]PE文件添加区段[逆向分析+asm代码实现]

关于我们

联系我们

企业服务

看雪公众号

专注于PC、移动、智能设备安全研究及逆向工程的开发者社区

最新回复 (7)
sdfcfy 雪币： 204 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 231 粉丝 0 关注私信	sdfcfy 2008-11-23 07:30 2 楼 0 好文，学习了
快雪时晴雪币： 326 活跃值： (15) 能力值： ( LV9，RANK：170 ) 在线值：发帖 34 回帖 2278 粉丝 1 关注私信	快雪时晴 4 2008-11-23 16:47 3 楼 0 TAG:PE SECTION 区段添加 ZEROADD LORDPE 我对PE的学习一直很怵
yxhxiaoqi 雪币： 201 活跃值： (10) 能力值： ( LV4，RANK：50 ) 在线值：发帖 9 回帖 95 粉丝 0 关注私信	yxhxiaoqi 1 2008-11-23 19:12 4 楼 0 好文章往都很长！
newjueqi 雪币： 202 活跃值： (25) 能力值： ( LV9，RANK：290 ) 在线值：发帖 22 回帖 392 粉丝 2 关注私信	newjueqi 7 2008-11-23 20:14 5 楼 0 太长太暴力了
himcrack 雪币： 221 活跃值： (11) 能力值： ( LV9，RANK：250 ) 在线值：发帖 8 回帖 194 粉丝 0 关注私信	himcrack 6 2008-11-24 22:59 6 楼 0 [QUOTE=;]...[/QUOTE] 我也是最近才认真学习PE格式的觉得挺有趣的希望高手们多多指点… BTW: .if后的条件怎么复合？
fnzhangyao 雪币： 200 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 44 粉丝 0 关注私信	fnzhangyao 2008-11-25 10:25 7 楼 0 [QUOTE=;]...[/QUOTE] 的确是精华。膜拜。
dxiaolin 雪币： 202 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 45 粉丝 0 关注私信	dxiaolin 2009-2-18 13:23 8 楼 0 学习，谢谢分享，我是菜鸟一个，还不是很懂我会努力的
	游客登录 \| 注册方可回帖　回帖　表情雪币赚取及消费高级回复