vc編寫自己的殼之一：對pe檔案OEP的修改

最近學習pe格式和寫殼，最終目標是寫出自己的殼，並有一定的anti能力．

調試了下修改pe檔案的oep，然後在新的進入點什麼都沒做，只是jmp回到原始進入點，程式繼續執行．測試通過． 準備明天在自己進入點的地方添加一個MessageBox代碼.

很多是網上朋友的代碼，借用下不好意思，如有著作權等問題請聯絡偶，偶會儘快處理，謝謝．

void CPeSecDlg::Go()
{
 HANDLE hFile, hMapping;
 void * basepointer = NULL;
 if(INVALID_HANDLE_VALUE == (hFile = CreateFile("C://CenterServer.exe",
  GENERIC_READ | GENERIC_WRITE,
  FILE_SHARE_READ | FILE_SHARE_WRITE,
  0,
  OPEN_EXISTING,
  FILE_FLAG_SEQUENTIAL_SCAN,
  0)))
 {
  AfxMessageBox("開啟失敗！！");
  return;
 }

 if(!(hMapping = CreateFileMapping(hFile, 0, PAGE_READONLY | SEC_COMMIT, 0, 0, 0)))
 {
  AfxMessageBox("CreateFileMapping開啟失敗！！");
  CloseHandle(hFile);
  return;
 }

 if(!(basepointer = MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, 0)))
 {
  AfxMessageBox("MapViewOfFile");
  CloseHandle(hMapping);
  CloseHandle(hFile);
  return;
 }

 IMAGE_DOS_HEADER * dos_head = (IMAGE_DOS_HEADER*)basepointer;
 IMAGE_NT_HEADERS * header = (IMAGE_NT_HEADERS*)((char*)dos_head + dos_head->e_lfanew);
 DWORD oldOEP = header->OptionalHeader.AddressOfEntryPoint;
 IMAGE_SECTION_HEADER * sectionHeader = (IMAGE_SECTION_HEADER*)(((char*)header + sizeof(IMAGE_NT_HEADERS)));

 //此段真實長度
 DWORD dwVirtSize = sectionHeader->Misc.VirtualSize;
 //此段物理位移
 DWORD dwPhysAddress = sectionHeader->PointerToRawData;
 //此段物理長度
 DWORD dwPhysSize = sectionHeader->SizeOfRawData;
 //取得此段的可用空間
 DWORD dwSpace = dwPhysSize - dwVirtSize;
 //取得程式的裝載地址
 DWORD dwProgRAV = header->OptionalHeader.ImageBase;

 //代碼位移一般為0
 DWORD dwCodeOffset = header->OptionalHeader.BaseOfCode - dwPhysAddress;

 //代碼寫入的物理位移
 DWORD dwEntryWrite = dwPhysAddress + dwVirtSize;
 if(0 != (dwEntryWrite%16))
 {
  dwEntryWrite += (16 - (dwEntryWrite%16));
 }

 //計算新的程式入口地址
 DWORD dwNewEntryAddress = dwEntryWrite + dwCodeOffset;

 //將jmp oldOEP的代碼寫入新的入口地址
 SetFilePointer(hFile, dwNewEntryAddress, NULL, FILE_BEGIN);
 //jmp oldOEP的16進值碼為0xE90002D820
 DWORD iWrited = 0;
 char cmd[4] = {0};
 ChangeDwordToString(/*0x0002D820*/0xFFFE069B, cmd);
/* cmd[0] = (char)0x00;
 cmd[1] = (char)0x02;
 cmd[2] = (char)0xD8;
 cmd[3] = (char)0x20;
 WriteFile(hFile, cmd, 4, &iWrited, NULL);
*/ char d[1] = {0};
 d[0] = (char)0xE9;
 WriteFile(hFile, d, 1, &iWrited, NULL);
 WriteFile(hFile, cmd, 4, &iWrited, NULL);

 //設定新的入口地址
 int nEntryPos = dos_head->e_lfanew + 40;
 SetFilePointer(hFile, nEntryPos, NULL, FILE_BEGIN);
 char pBuffer[4] = {0};
 ChangeDwordToString(/*0x0002D820*/dwNewEntryAddress, pBuffer);
 WriteFile(hFile, pBuffer, 4, &iWrited, NULL);

 //OK
}

//轉換DWORD為字串，並轉換成低低高高順序
void CPeSecDlg::ChangeDwordToString(DWORD d, char *cBuffer)
{
 unsigned char waddress[4] = {0};

 cBuffer[3] = (char)(d>>24)&0xFF;
 cBuffer[2] = (char)(d>>16)&0xFF;
 cBuffer[1] = (char)(d>>8)&0xFF;
 cBuffer[0] = (char)(d)&0xFF;
}