关于PE文件内存加载的错误

Met32

1)、把一个PE文件读入内存缓冲区File->FileBuffer
2)、PE文件的拉伸，FileBuffer->ImageBuffer
3)、PE文件的还原，开辟另一块空间，把ImageBuffer重新还原成文件刚加载进内存时的样子
4)、PE文件的转存，把3得到的结果转存为文件，看看是否可以运行
滴水逆向2015-03-16期课后做业
编译器提示好像是 memcpy错误
如有大佬解决，有偿一包烟钱~~ 可以加我Q 2070002026

1. #include "stdafx.h"
   
2. #include<windows.h>
   
3. #include<winnt.h>
   
4. #include<stdlib.h>
   
5. #define IMAGE_SIZEOF_SHORT_NAME        8
   
6. LPVOID ReadPEFile(IN LPSTR lpszFile){
   
7.         FILE* Pfile = NULL;
   
8.         LPVOID pFileBuffer = NULL;
   
9.         Pfile = fopen(lpszFile,"rb");
   
10.         if(!Pfile){
    
11.                 printf("无法打开exe程序");
    
12.                 return NULL;
    
13.         }
    
14.         fseek(Pfile,0,SEEK_END);
    
15.         DWORD fileSize = ftell(Pfile);//文件大小
    
16.         fseek(Pfile,0,SEEK_SET);
    
17.         pFileBuffer=(char*)malloc(fileSize);//分配文件大小
    
18.         //将文件数据读入缓冲区
    
19.         size_t n = fread(pFileBuffer,fileSize,1,Pfile);
    
20.         if(!n){
    
21.                 printf("读取数据失败\n");
    
22.                 free(pFileBuffer);
    
23.                 fclose(Pfile);
    
24.                 return NULL;
    
25.         }
    
26.         fclose(Pfile);
    
27.         return pFileBuffer;
    
28. 
    
29. }
    
30. LPVOID CopyFileBufferToImageBuffer(){
    
31.         LPVOID pFileBuffer = NULL;
    
32.         LPVOID pimageBuffer = NULL;
    
33.         PIMAGE_DOS_HEADER pdosheader = NULL;
    
34.         PIMAGE_NT_HEADERS pntheader= NULL;
    
35.         PIMAGE_FILE_HEADER pheader= NULL;
    
36.         PIMAGE_OPTIONAL_HEADER poptionheader = NULL;
    
37.         PIMAGE_SECTION_HEADER psection = NULL;
    
38.         pFileBuffer = ReadPEFile("C:\\Windows\\SysWOW64\\notepad.exe");//读文件到缓冲区
    
39.         if(!pFileBuffer){
    
40.                 printf("读文件失败");
    
41.                 return NULL;
    
42.         }
    
43.         pdosheader = (PIMAGE_DOS_HEADER)pFileBuffer;
    
44.         DWORD pe = pdosheader->e_lfanew+0x4;//pe标识
    
45.         pheader = (PIMAGE_FILE_HEADER)(DWORD)pFileBuffer+pe;
    
46.         DWORD pebz = sizeof(IMAGE_FILE_HEADER);
    
47.         poptionheader =  (PIMAGE_OPTIONAL_HEADER)(DWORD)pheader+pebz;
    
48.         pimageBuffer = malloc(poptionheader->SizeOfImage);
    
49.         //memset(pimageBuffer,0,poptionheader->SizeOfImage);
    
50.         memcpy(pimageBuffer,pFileBuffer,((size_t)poptionheader->SizeOfImage));//copy的整体的大小
    
51.         psection = (PIMAGE_SECTION_HEADER)((DWORD)poptionheader+poptionheader->SizeOfImage);//节表
    
52.         for(int i=0;i<pheader->NumberOfSections;i++,psection++){
    
53.                 memcpy((void*)((DWORD)pimageBuffer+psection->VirtualAddress),(void*)((DWORD)pheader+psection->PointerToRawData),((size_t)psection->SizeOfRawData));//拷贝到pimageBuffer
    
54. 
    
55. 
    
56. 
    
57.         }
    
58.         return pimageBuffer;
    
59. }
    
60. LPVOID CopyImageBufferToNewBuffer(LPSTR lpszFile){
    
61.         LPVOID pnewbuffer = NULL;
    
62.         LPVOID pimageBuffer = NULL;
    
63.         PIMAGE_DOS_HEADER pdosheader = NULL;
    
64.         PIMAGE_NT_HEADERS pntheader= NULL;
    
65.         PIMAGE_FILE_HEADER pheader= NULL;
    
66.         PIMAGE_OPTIONAL_HEADER poptionheader = NULL;
    
67.         PIMAGE_SECTION_HEADER psection = NULL;
    
68.         FILE* f = NULL;
    
69.         char* FilePath = "D:\\zuoye\\Notpead1.exe";
    
70.         pimageBuffer=CopyFileBufferToImageBuffer();//缓冲区内存
    
71. //        pnewbuffer = malloc(fileSize);
    
72.         FILE* pfile = fopen(lpszFile,"rb");
    
73.         fseek(pfile,0,SEEK_END);
    
74.         DWORD fileSize = ftell(pfile);
    
75.         pnewbuffer = malloc(fileSize);
    
76.         memset(pnewbuffer,0,fileSize);
    
77.         pdosheader = (PIMAGE_DOS_HEADER)pimageBuffer;
    
78.         pntheader = (PIMAGE_NT_HEADERS)((DWORD)pimageBuffer+pdosheader->e_lfanew);
    
79.         pheader = (PIMAGE_FILE_HEADER)((DWORD)pntheader+4);
    
80.         poptionheader = (PIMAGE_OPTIONAL_HEADER)((DWORD)pheader+IMAGE_SIZEOF_FILE_HEADER);//PE标准头
    
81.         memcpy(pnewbuffer,pimageBuffer,poptionheader->SizeOfHeaders);//复制到pnewbuffer
    
82.         psection =(PIMAGE_SECTION_HEADER)((DWORD)poptionheader+ pheader->SizeOfOptionalHeader);
    
83.         for(int i=0;i<pheader->NumberOfSections;i++,psection++){
    
84.                 memcpy((void*)((DWORD)pnewbuffer+psection->PointerToRawData),(void*)((DWORD)pimageBuffer+psection->VirtualAddress),(size_t)(psection->SizeOfRawData));
    
85.                 }
    
86.         f = fopen(FilePath,"wb");
    
87.         fwrite(pnewbuffer,fileSize,1,f);
    
88.         fclose(f);
    
89.         return 0;
    
90. }
    
91. int main(int argc, char* argv[])
    
92. {
    
93.    CopyImageBufferToNewBuffer("C:\\Windows\\SysWOW64\\notepad.exe");
    
94.   
    
95. 
    
96.          
    
97.          return 0;
    
98. }
    

复制代码

jadeshu

大小计算错误

xiao14116

这代码，连个注释都没有，大量的变量都不知道是啥意思，谁有耐心去看