解析PE檔案的附加資料

解析程式自己的附加資料，將附加資料寫入檔案中。

主要是解析PE檔案頭，定位到overlay的地方，寫入檔案。常應用的情境是在crackme中，crackme自身有一段加密過的附加資料，在crackme啟動並執行過程中解析自己的附加資料，然後解密這段資料。。。。

代碼留存：

//解析自己的PE檔案TCHAR szModuleFile[MAX_PATH] = {0};::GetModuleFileName(NULL, szModuleFile, MAX_PATH);HANDLE hFile = ::CreateFile(szModuleFile, 0X80000000, 0X1, NULL, 0x3, 0x80, NULL );if (!hFile){AfxMessageBox("create file error");return ;}DWORD dwFileSize = 0;dwFileSize = ::GetFileSize(hFile, NULL);if (!dwFileSize){AfxMessageBox("GetFileSize error");return ;}TCHAR *pBuffer = new TCHAR[dwFileSize+1];DWORD dwReadBytes = 0;BOOL bSuc = ::ReadFile(hFile, pBuffer, dwFileSize, &dwReadBytes, NULL);if (!bSuc){AfxMessageBox("read file error");return ;}IMAGE_DOS_HEADER *pDosHead =(IMAGE_DOS_HEADER *)pBuffer;  IMAGE_NT_HEADERS *pNtHeader;    // 得到PE檔案頭.  pNtHeader = (IMAGE_NT_HEADERS*)((char*)pDosHead + pDosHead->e_lfanew);WORD wNumOfSection = pNtHeader->FileHeader.NumberOfSections;//DWORD dwTemp = wNumOfSection * (sizeof(IMAGE_SECTION_HEADER)/sizeof(DWORD));WORD wSizeOfOptionalHeader = pNtHeader->FileHeader.SizeOfOptionalHeader;DWORD *pOverLay;DWORD *pLastSectionVirualAddress;DWORD *pLastSectionVirualSize;DWORD *pLastSectionPhyAddress, *pLastSectionPhySize;pLastSectionVirualSize = (DWORD*) ((char*)pNtHeader+ sizeof(IMAGE_NT_HEADERS) + (wNumOfSection-1)*sizeof(IMAGE_SECTION_HEADER) + sizeof(BYTE)*IMAGE_SIZEOF_SHORT_NAME );pLastSectionVirualAddress = pLastSectionVirualSize + 1;pLastSectionPhyAddress = pLastSectionVirualSize + 2;pLastSectionPhySize = pLastSectionVirualSize + 3;DWORD dw1 = *pLastSectionPhyAddress;DWORD dw2 = *pLastSectionPhySize;pOverLay = (DWORD*)(dw1 + dw2 + pBuffer);DWORD dwOverlaySize = dwFileSize - (dw1 + dw2);HANDLE hOutFile = ::CreateFile("C:\\Users\\Administrator\\Desktop\\crackme.exe.overlay", GENERIC_WRITE, FILE_SHARE_READ, NULL, CREATE_NEW, NULL, NULL);if (!hOutFile){return ;}DWORD dwWritten = 0;::WriteFile(hOutFile, pOverLay, dwOverlaySize, &dwWritten, NULL);::CloseHandle(hOutFile);if ((char *)pOverLay == 0x0){AfxMessageBox("附加資料首位元組為0");return ;}::free(pBuffer);::CloseHandle(hFile);