扩大节

在空白区添加代码，如果节区的空白区空间不够，代码长度也受限，此时就需要扩大节区。一般扩大最后一个节，不需要对前面的节进行调整。

手动修改

步骤：

  1. 分配一块新的空间，大小为S
  2. 由于无法确保VirtualSize一定比SizeOfRawData大，所以将最后一个节的SizeOfRawData和VirtualSize都改成N
    N = （SizeOfRawData和VirtualSize对齐后的值）+ S
  3. 修改SizeOfImage
    SizeOfImage = SizeOfImage + S
  4. 如果要插入代码需要修改节区包含代码段和可执行属性，修改IMAGE_SECTION_HEADER.Characteristics，将节的IMAGE_SCN_CNT_CODE和IMAGE_SCN_MEM_EXECUTE标志位置1。

如上图，此处S为0x1000，SizeOfRawData > VirtualSize，将SizeOfRawData改为0x1600，VirtualSize也修改为相同的值，最后修改SizeOfImage为0x021000

代码实现

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
#include<Windows.h>
#include<stdio.h>
#include<stdlib.h>

#define FILEPATH TEXT("test.exe")

typedef struct {
  LPVOID lpBuf;
  DWORD size;
}FILEINFO;

BOOL readFile(LPCTSTR filePath, FILEINFO *fileInfo) {
  HANDLE hFile = CreateFile(
    filePath,
    GENERIC_READ,
    0,
    NULL,
    OPEN_EXISTING,
    FILE_ATTRIBUTE_NORMAL,
    0
  );

  if (!hFile) {
    OutputDebugString(TEXT("CreateFile Error\n"));
    return FALSE;
  }

  LPVOID fileBuf;

  DWORD fileSize = GetFileSize(hFile, NULL);

  fileBuf = malloc(fileSize);

  memset(fileBuf, 0, fileSize);

  if (!ReadFile(
    hFile,
    fileBuf,
    fileSize,
    NULL,
    NULL
  )) {
    return FALSE;
  }

  CloseHandle(hFile);

  fileInfo->lpBuf = fileBuf;
  fileInfo->size = fileSize;
  return TRUE;
}



int main(int argc, char *argv[]) {
  HANDLE hFile;
  LPVOID zeroMem;
  FILEINFO fileInfo;

  readFile(FILEPATH, &fileInfo);

  PIMAGE_DOS_HEADER pIDH = (PIMAGE_DOS_HEADER)fileInfo.lpBuf;
  PIMAGE_NT_HEADERS pINH = (PIMAGE_NT_HEADERS)((DWORD)pIDH + pIDH->e_lfanew);
  PIMAGE_FILE_HEADER pIFH = (PIMAGE_FILE_HEADER)((DWORD)pINH + 4);
  PIMAGE_OPTIONAL_HEADER pIOH = (PIMAGE_OPTIONAL_HEADER)((DWORD)pIFH + 20);
  PIMAGE_SECTION_HEADER pISHs = (PIMAGE_SECTION_HEADER)((DWORD)pIOH + pIFH->SizeOfOptionalHeader);
  //定位到最后一个节头
  PIMAGE_SECTION_HEADER pLastISH = (PIMAGE_SECTION_HEADER)((DWORD)pISHs + (pIFH->NumberOfSections - 1) * 40);

  if (pLastISH->Misc.VirtualSize > pLastISH->SizeOfRawData) {
    pLastISH->Misc.VirtualSize += 0x1000;
    pLastISH->SizeOfRawData = pLastISH->Misc.VirtualSize;
  }
  else {
    pLastISH->SizeOfRawData += 0x1000;
    pLastISH->Misc.VirtualSize = pLastISH->SizeOfRawData;
  }

  pIOH->SizeOfImage += 0x1000;

  /*将节的属性设置为包含代码段，和可执行*/
  pLastISH->Characteristics =
    (pLastISH->Characteristics | IMAGE_SCN_CNT_CODE) | IMAGE_SCN_MEM_EXECUTE;

  hFile = CreateFile(
    FILEPATH,
    GENERIC_WRITE | GENERIC_READ,
    0,
    NULL,
    CREATE_ALWAYS,
    FILE_ATTRIBUTE_NORMAL,
    0
  );

  if (!hFile) {
    OutputDebugString("CreateFile error\n");
    free(fileInfo.lpBuf);
    CloseHandle(hFile);
    return 0;
  }

  SetFilePointer(hFile, 0, 0, FILE_BEGIN);

  WriteFile(hFile, fileInfo.lpBuf, fileInfo.size, NULL, NULL);

  zeroMem = malloc(0x1000);
  memset(zeroMem, 0, 0x1000);

  SetFilePointer(hFile, 0, 0, FILE_END);

  WriteFile(hFile, zeroMem, 0x1000, NULL, NULL);

  CloseHandle(hFile);
  free(zeroMem);
  free(fileInfo.lpBuf);

}