Way of researcher: Добавление крайней секции в PE файл

Техника добавления крайней секции в PE файлы. Демонстрируются следующие фитчи:
- Добавление последней секции и внесение в неё данных из файла
- Пересчёт PE checksum (IMAGE_OPTIONAL_HEADER.Checksum)
- Сдвиг оверлея
- Сдвиг Bound Import заголовков
- Поддержка PE и PE+(x64)

TODO:
- Выравнивание согласно IMAGE_OPTIONAL_HEADER.FileAligment

// --------------------------------------------------------------
// This is example, how to add section to PE file,
// supported PE and PE+(x86-64)
// by JKornev <c> http://k0rnev.blogspot.com
// --------------------------------------------------------------
#include <stdio.h>
#include <Windows.h>
#include <ImageHlp.h>

#pragma comment(lib, "ImageHlp")

#define NEW_SECTION_NAME ".new"
#define NEW_SECT_CHARACTERISTICS 0xC0000040

UINT Aligment(UINT size, UINT aligm_base)
{
    UINT new_size = size;
    if (size % aligm_base != 0) {
        new_size += aligm_base - (size % aligm_base);
    }
    return new_size;
}

void OutputSections(PIMAGE_SECTION_HEADER psect, int count)
{
    char name[IMAGE_SIZEOF_SHORT_NAME + 1] = {0};
    int i;

    for (i = 0; i < count; i++) {
        memcpy(name, psect[i].Name, IMAGE_SIZEOF_SHORT_NAME);
        printf(" %8s VA:0x%08X VS:0x%08X RA:0x%08X RS:0x%08X\n",
            name, psect[i].VirtualAddress, psect[i].Misc.VirtualSize,
            psect[i].PointerToRawData, psect[i].SizeOfRawData);
    }
}

DWORD MoveBoundImport(PVOID pbase, UINT base_size, DWORD lowbound, PIMAGE_DATA_DIRECTORY pdir, int move_dist)
{
    DWORD offset;

    if (!pdir->VirtualAddress || !move_dist) {
        return 0;
    }

    offset = (DWORD)((int)pdir->VirtualAddress + move_dist);//new offset pdir->VirtualAddress 
    if (lowbound > offset || offset + pdir->Size > base_size) {
        return 0;//overflow
    }

    //move bound block, recalculate offsets not need
    memmove((PVOID)((UINT)pbase + offset), (PVOID)((UINT)pbase + pdir->VirtualAddress), pdir->Size);

    return offset;
}

int main(int argc, char *argv[])
{
    enum { PE_DEFAULT_HEADER_SIZE = 0x400 };//usually PE header raw size is 0x400
    char *phead, *pdata, *poverl;
    HANDLE hfile, hfile2, hmap;
    DWORD pe_size, readed, written, offset, i, 
        data_size, overl_size, old_checksum, new_checksum;
    PIMAGE_DOS_HEADER pdos;
    PIMAGE_FILE_HEADER pimg;
    PIMAGE_SECTION_HEADER psect, pnew_sect;
    PIMAGE_OPTIONAL_HEADER32 popt32;
    PIMAGE_OPTIONAL_HEADER64 popt64;
    PIMAGE_DATA_DIRECTORY pdir;
    PIMAGE_NT_HEADERS32 pnt32;
    PIMAGE_NT_HEADERS64 pnt64;
    BOOL is_x64, have_checksum;
    PVOID pview;

    if (argc < 3) {
        printf("Error, incorrect arguments!\n"
            "Format: add.exe \"pe file name\" \"data file name\"\n");
        return 1;
    }

    // Read PE header
    phead = (char *)malloc(PE_DEFAULT_HEADER_SIZE);
    if (!phead) {
        printf("Error, can't allocate buffer!\n");
        return 1;
    }

    hfile = CreateFileA(argv[1], GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
    if (hfile == INVALID_HANDLE_VALUE) {
        printf("Error, can't open PE file '%s'!\n", argv[1]);
        return 1;
    }

    pe_size = GetFileSize(hfile, NULL);

    if (!ReadFile(hfile, phead, PE_DEFAULT_HEADER_SIZE, &readed, NULL)) {
        printf("Error, reading PE file failed!\n");
        return 1;
    }

    // Check DOS header
    offset = 0;
    pdos = (PIMAGE_DOS_HEADER)phead;
    if (pdos->e_magic != IMAGE_DOS_SIGNATURE) {
        printf("Error, '%s' isn't PE file!\n", argv[1]);
        return 1;
    }
    offset = pdos->e_lfanew + sizeof(DWORD)/*PE signature*/;

    pimg = (PIMAGE_FILE_HEADER)(phead + offset);
    offset += sizeof(IMAGE_FILE_HEADER);

    // Check architecture
    if (pimg->Machine == IMAGE_FILE_MACHINE_I386) {
        is_x64 = FALSE;
        popt32 = (PIMAGE_OPTIONAL_HEADER32)(phead + offset);
        offset += sizeof(IMAGE_OPTIONAL_HEADER32);
    } else if (pimg->Machine == IMAGE_FILE_MACHINE_AMD64) {
        is_x64 = TRUE;
        popt64 = (PIMAGE_OPTIONAL_HEADER64)(phead + offset);
        offset += sizeof(IMAGE_OPTIONAL_HEADER64);
    } else {
        printf("Error, architecture not supported!\n");
        return 1;
    }

    // Get section ptr
    psect = (PIMAGE_SECTION_HEADER)(phead + offset);
    offset += sizeof(IMAGE_SECTION_HEADER) * pimg->NumberOfSections;

    printf("Sections before:\n");
    OutputSections(psect, pimg->NumberOfSections);

    // Check bound import table and shift it if need
    if (is_x64) {
        pdir = &popt64->DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT];
    } else {
        pdir = &popt32->DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT];
    }
    if (pdir->VirtualAddress < offset + sizeof(IMAGE_SECTION_HEADER)) {//if need more space for new section header
        //try to move or disable bound import
        pdir->VirtualAddress = MoveBoundImport(phead, PE_DEFAULT_HEADER_SIZE, offset,
            pdir, offset + sizeof(IMAGE_SECTION_HEADER) - pdir->VirtualAddress);
        if (!pdir->VirtualAddress) {
            printf("Warning, can't move bound import table! Bound import disabled.\n");
            pdir->Size = 0;
        }
    }

    // Read data
    hfile2 = CreateFileA(argv[2], GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, NULL);
    if (hfile2 == INVALID_HANDLE_VALUE) {
        printf("Error, can't open data file '%s'!\n", argv[2]);
        return 1;
    }

    data_size = GetFileSize(hfile2, NULL);
    if (!data_size) {
        printf("Error, file '%s' is empty!\n", argv[2]);
        return 1;
    }

    pdata = (char *)malloc(data_size);
    if (!pdata) {
        printf("Error, can't allocate data buffer!\n");
        return 1;
    }

    if (!ReadFile(hfile2, pdata, data_size, &readed, NULL)) {
        printf("Error, reading data file failed!\n");
        return 1;
    }

    // Create new section header
    pnew_sect = &psect[pimg->NumberOfSections];
    memset(pnew_sect, 0, sizeof(IMAGE_SECTION_HEADER));
    memcpy(pnew_sect->Name, NEW_SECTION_NAME, strlen(NEW_SECTION_NAME));
    pnew_sect->Characteristics = NEW_SECT_CHARACTERISTICS;//rwi 
    pnew_sect->SizeOfRawData = data_size;
    if (is_x64) {
        pnew_sect->VirtualAddress = popt64->SizeOfImage;
        pnew_sect->Misc.VirtualSize = Aligment(data_size, popt64->SectionAlignment);
    } else {
        pnew_sect->VirtualAddress = popt32->SizeOfImage;
        pnew_sect->Misc.VirtualSize = Aligment(data_size, popt32->SectionAlignment);
    }
    for (i = 0; i < pimg->NumberOfSections; i++) {//search raw offset
        if (pnew_sect->PointerToRawData <= psect[i].PointerToRawData && psect[i].SizeOfRawData) {
            pnew_sect->PointerToRawData = psect[i].PointerToRawData + psect[i].SizeOfRawData;
        }
    }

    // Shift overlay
    overl_size = pe_size - pnew_sect->PointerToRawData;//calculate overlay size
    if (overl_size > 0) {
        poverl = (char *)malloc(overl_size);
        if (!poverl) {
            printf("Error, can't allocate temp buffer!\n");
            return 1;
        }

        SetFilePointer(hfile, pnew_sect->PointerToRawData, 0, FILE_BEGIN);
        if (!ReadFile(hfile, poverl, overl_size, &readed, NULL)) {
            printf("Error, reading overlay failed!\n");
            return 1;
        }

        SetFilePointer(hfile, pnew_sect->PointerToRawData + data_size, 0, FILE_BEGIN);
        if (!WriteFile(hfile, poverl, overl_size, &written, NULL)) {
            printf("Error, can't save overlay!\n");
            return 1;
        }
        free(poverl);
    }

    // Put data
    SetFilePointer(hfile, pnew_sect->PointerToRawData, 0, FILE_BEGIN);
    if (!WriteFile(hfile, pdata, data_size, &written, NULL)) {
        printf("Error, can't save new data!\n");
        return 1;
    }

    // Change header info
    pimg->NumberOfSections++;
    if (is_x64) {
        popt64->SizeOfImage = pnew_sect->VirtualAddress + pnew_sect->Misc.VirtualSize;
    } else {
        popt32->SizeOfImage = pnew_sect->VirtualAddress + pnew_sect->Misc.VirtualSize;
    }

    // Save header
    SetFilePointer(hfile, 0, 0, FILE_BEGIN);
    if (!WriteFile(hfile, phead, PE_DEFAULT_HEADER_SIZE, &written, NULL)) {
        printf("Error, can't save new header!\n");
        return 1;
    }
    FlushFileBuffers(hfile);

    // Recalculate checksum (optional feature)
    if (is_x64) {
        have_checksum = (popt64->CheckSum ? TRUE : FALSE);
    } else {
        have_checksum = (popt32->CheckSum ? TRUE : FALSE);
    }
    if (have_checksum) {
        hmap = CreateFileMapping(hfile, NULL, PAGE_READWRITE, 0, 0, NULL);
        pview = MapViewOfFile(hmap, FILE_MAP_READ | FILE_MAP_WRITE, 0, 0, 0);
        if (pview) {
            if (is_x64) {
                if (pnt64 = (PIMAGE_NT_HEADERS64)CheckSumMappedFile(pview, pe_size + data_size, &old_checksum, &new_checksum)) {
                    pnt64->OptionalHeader.CheckSum = new_checksum;
                } else {
                    printf("Warning, can't recalc header checksum!\n");
                }
            } else {
                if (pnt32 = (PIMAGE_NT_HEADERS32)CheckSumMappedFile(pview, pe_size + data_size, &old_checksum, &new_checksum)) {
                    pnt32->OptionalHeader.CheckSum = new_checksum;
                } else {
                    printf("Warning, can't recalc header checksum!\n");
                }
            }
            UnmapViewOfFile(pview);
        } else {
            printf("Warning, can't recalc header checksum!\n");
        }
        if (hmap) {
            CloseHandle(hmap);
        }
    }

    printf("Sections after:\n");
    OutputSections(psect, pimg->NumberOfSections);
    printf("Operation successful!\n");

    free(phead);
    free(pdata);
    CloseHandle(hfile2);
    CloseHandle(hfile);

    return 0;
}

Way of researcher

Страницы

вторник, 19 ноября 2013 г.

Добавление крайней секции в PE файл

Комментариев нет:

Отправить комментарий

Архив блога

Ярлыки

Полезные ссылки

Постоянные читатели