Way of researcher: Изменение размера произвольной секций PE файла

Пример техники изменения виртуального размера произвольной секции исполняемого файла и нормализации связей через релоки. Реализованы следующие фитчи:
- Изменение виртуального размера произвольной секции
- Нормализация смещений PE заголовков (включая импорты, экспорты, ресурсы и т.д.)
- Нормализация виртуальных адресов через релоки
- Поддержка PE и PE+(x64) частично
и т.д.

Данный код работает только с модулями имеющими релоки, однако в некоторых местах я ставил дополнительные проверки на отсутствие релоков, это сделано для того чтобы показать места в которых выполняется нормализация смещения по VA(Virtual Adress), не путать с RVA(Relative Virtual Address). Дело в том что все такие VA описиваются релокоми, поэтому эти адреса будут нормализованы при нормализации релоков, однако без релоков это нужно делать в ручную.

Описание техники см. в статье о расширении секций PE приложений
* Важно подчеркнуть что возможны траблы при увеличении размера секций кода для x64(PE+), проблема описана в статье указанной выше.

resizer.h

// --------------------------------------------------------------
// File : resizer.h
// This is example, how to change any section size,
// supported PE and PE+(x64)
// by JKornev <c> http://k0rnev.blogspot.com
// --------------------------------------------------------------
#pragma once

#include <Windows.h>

typedef struct _IMAGE_DELAY_IMPORT_DESCRIPTOR {
    DWORD   Characteristics;
    DWORD    szName;
    DWORD    phmod;
    DWORD    pIAT;
    DWORD    pINT;
    DWORD    pBoundIAT;
    DWORD    pUnloadIAT;
    DWORD    dwTimeStamp;
} IMAGE_DELAY_IMPORT_DESCRIPTOR;
typedef IMAGE_DELAY_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_DELAY_IMPORT_DESCRIPTOR;

#ifndef _IA64_
typedef struct _RUNTIME_FUNCTION {
    ULONG BeginAddress;
    ULONG EndAddress;
    ULONG UnwindData;
} RUNTIME_FUNCTION, *PRUNTIME_FUNCTION;
#endif

typedef struct _UAddress {
    union {
        ULONGLONG val64;
        struct {
            UINT val32l;//lo
            UINT val32h;//hi
        };
    };
} UAddress, *PUAddress;

class CPEResize {
private:
    bool _opened;//PE app

    HANDLE _hfile;
    HANDLE _hmap;
    char *_pview;

    unsigned int _filesize;

    //PE structs and vars
    bool _is_x64;
    unsigned int _aligm;
    PIMAGE_FILE_HEADER _pimg;
    PIMAGE_OPTIONAL_HEADER32 _popt32;
    PIMAGE_OPTIONAL_HEADER64 _popt64;
    PIMAGE_DATA_DIRECTORY _pdir;
    PIMAGE_SECTION_HEADER _psects;

    UAddress _imgbase;

    int _diff;//virtual difference
    DWORD _diff_ofst;//difference base offset

    bool NormalizeRelocs();
    bool NormalizeImport();
    bool NormalizeExport();
    bool NormalizeResource();
    bool NormalizeException();
    bool NormalizeTls();
    bool NormalizeDebug();
    bool NormalizeConfig();
    bool NormalizeDelayImport();

    //Convert virtual offset to data ptr
    PBYTE GetDataPtr(DWORD voffset, int *sect_inx);
    static UINT Aligment(UINT size, UINT aligm_base);
    bool RecurRCNodeNormalize(DWORD dir_addr);

public:
    CPEResize();
    ~CPEResize();

    //Open and close PE\PE+ applications
    bool OpenModule(char *path);
    void CloseModule();

    //Resize section by index(0, 1, ...)
    //Warning! If function failed it can corrupt PE application,
    //you must create backup before resizing
    bool ChangeSectorSize(UINT sector_num, UINT vsize);
};

resizer.cpp

// --------------------------------------------------------------
// File : resizer.cpp
// This is example, how to change any section size,
// supported PE and PE+(x64)
// by JKornev <c> http://k0rnev.blogspot.com
// --------------------------------------------------------------
#include "resizer.h"
#include <stdint.h>

CPEResize::CPEResize() : _opened(false), _hfile(INVALID_HANDLE_VALUE), _hmap(NULL), _pview(NULL)
{
}

CPEResize::~CPEResize()
{
    CloseModule();
}

bool CPEResize::OpenModule(char *path)
{
    DWORD hisize, offset;
    PIMAGE_DOS_HEADER pdos;

    if (_opened) {
        return false;
    }

    //Open PE app
    _hfile = CreateFileA(path, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
    if (_hfile == INVALID_HANDLE_VALUE) {
        return false;
    }

    _filesize = GetFileSize(_hfile, &hisize);
    if (hisize) {//app oversize
        CloseModule(); 
        return false;
    }

    //Create file mapping
    _hmap = CreateFileMappingA(_hfile, NULL, PAGE_READWRITE, 0, 0, NULL);
    if (!_hmap) {
        CloseModule(); 
        return false;
    }
    _pview = (char *)MapViewOfFile(_hmap, FILE_MAP_ALL_ACCESS, 0, 0, 0);
    if (!_pview) {
        CloseModule();
        return false;
    }

    //Parse PE header
    offset = 0;
    pdos = (PIMAGE_DOS_HEADER)_pview;
    if (pdos->e_magic != IMAGE_DOS_SIGNATURE) {
        CloseModule();
        return false;
    }
    offset = pdos->e_lfanew + sizeof(DWORD)/*PE signature*/;

    _pimg = (PIMAGE_FILE_HEADER)(_pview + offset);
    offset += sizeof(IMAGE_FILE_HEADER);

    //Check architecture
    if (_pimg->Machine == IMAGE_FILE_MACHINE_I386) {
        _is_x64 = FALSE;
        _popt32 = (PIMAGE_OPTIONAL_HEADER32)(_pview + offset);
        _pdir = _popt32->DataDirectory;
        _aligm = _popt32->SectionAlignment;
        _imgbase.val32l = _popt32->ImageBase;
        _imgbase.val32h = 0;
        offset += sizeof(IMAGE_OPTIONAL_HEADER32);
    } else if (_pimg->Machine == IMAGE_FILE_MACHINE_AMD64) {
        _is_x64 = TRUE;
        _popt64 = (PIMAGE_OPTIONAL_HEADER64)(_pview + offset);
        _pdir = _popt64->DataDirectory;
        _aligm = _popt64->SectionAlignment;
        _imgbase.val64 = _popt64->ImageBase;
        offset += sizeof(IMAGE_OPTIONAL_HEADER64);
    } else {//architecture not supported
        CloseModule();
        return false;
    }

    //Resize method works only for apps with relocs
    if (!_pdir[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress) {
        CloseModule();
        return false;
    }

    //Get section ptr
    _psects = (PIMAGE_SECTION_HEADER)(_pview + offset);

    return _opened = true;
}

void CPEResize::CloseModule()
{
    if (_pview) {
        UnmapViewOfFile(_pview);
        _pview = NULL;
    }
    if (_hmap) {
        CloseHandle(_hmap);
        _hmap = NULL;
    }
    if (_hfile != INVALID_HANDLE_VALUE) {
        CloseHandle(_hfile);
        _hfile = INVALID_HANDLE_VALUE;
    }
    _opened = false;
}

bool CPEResize::ChangeSectorSize(UINT num, UINT vsize)
{
    if (!_opened) {
        return false;
    }

    if (num + 1 > _pimg->NumberOfSections) {//section not found
        return false;
    }
    if (_psects[num].SizeOfRawData > vsize) {//can't cut raw data
        return false;
    }

    _diff = Aligment(vsize, _aligm) - Aligment(_psects[num].Misc.VirtualSize, _aligm);
    _diff_ofst = Aligment(_psects[num].VirtualAddress + _psects[num].Misc.VirtualSize, _aligm);
    if (_diff == 0) {//resize without normalize
        _psects[num].Misc.VirtualSize = vsize;
        return true;
    }

    //Normalizing
    if (!NormalizeRelocs()) {
        return false;
    }
    if (!NormalizeImport()) {
        return false;
    }
    if (!NormalizeExport()) {
        return false;
    }
    if (!NormalizeResource()) {
        return false;
    }
    if (!NormalizeException()) {
        return false;
    }
    if (!NormalizeTls()) {
        return false;
    }
    if (!NormalizeDebug()) {
        return false;
    }
    if (!NormalizeConfig()) {
        return false;
    }
    if (!NormalizeDelayImport()) {
        return false;
    }

    //Recalculate section headers
    _psects[num].Misc.VirtualSize = vsize;
    for (int i = num + 1; i < _pimg->NumberOfSections; i++) {
        if (_psects[i].VirtualAddress >= _diff_ofst) {
            _psects[i].VirtualAddress = (int)_psects[i].VirtualAddress + _diff;
        }
    }

    //Recalculate optional header
    if (_is_x64) {
        _popt64->SizeOfImage = (int)_popt64->SizeOfImage + _diff;
        if (_popt64->AddressOfEntryPoint >= _diff_ofst) {
            _popt64->AddressOfEntryPoint = (int)_popt64->AddressOfEntryPoint + _diff;
        }
        if (_popt64->BaseOfCode >= _diff_ofst) {
            _popt64->BaseOfCode = (int)_popt32->BaseOfCode + _diff;
        }
    } else {
        _popt32->SizeOfImage = (int)_popt32->SizeOfImage + _diff;
        if (_popt32->AddressOfEntryPoint >= _diff_ofst) {
            _popt32->AddressOfEntryPoint = (int)_popt32->AddressOfEntryPoint + _diff;
        }
        if (_popt32->BaseOfCode >= _diff_ofst) {
            _popt32->BaseOfCode = (int)_popt32->BaseOfCode + _diff;
        }
        if (_popt32->BaseOfData >= _diff_ofst) {
            _popt32->BaseOfData = (int)_popt32->BaseOfData + _diff;
        }
    }
    //Recalculate directories
    for (int i = 0; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++) {
        if (_pdir[i].VirtualAddress >= _diff_ofst) {
            _pdir[i].VirtualAddress = (int)_pdir[i].VirtualAddress + _diff;
        }
    }

    return true;
}

bool CPEResize::NormalizeRelocs()
{
    PIMAGE_BASE_RELOCATION prel;
    PBYTE rel_buf, buf;
    unsigned int rel_size, rel_count;
    int inx;
    WORD rtype, rofst;

    if (!_pdir[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress) {
        return true;//not need
    }

    rel_buf = GetDataPtr(_pdir[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress, NULL);
    rel_size = _pdir[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size;

    //enumerate all relocs
    for (int i = 0; i < rel_size;) {
        prel = (PIMAGE_BASE_RELOCATION)(rel_buf + i);
        i += prel->SizeOfBlock;

        if (!prel->VirtualAddress && !prel->SizeOfBlock) {
            break;
        }

        rel_count = (prel->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);

        for (int a = 0; a < rel_count; a++) {
            rofst = *(WORD *)((DWORD)prel + sizeof(IMAGE_BASE_RELOCATION) + (sizeof(WORD) * a));
            rtype = rofst >> 12;//4 bits of type
            rofst = ((DWORD)((DWORD)rofst << 20) >> 20);//12 bits of offset

            buf = (PBYTE)GetDataPtr(prel->VirtualAddress, &inx);
            if (!buf || inx < 0) {//can't find reloc
                return false;
            }

            //recalc virtual addresses
            if (rtype == IMAGE_REL_BASED_HIGHLOW) {//32 bit address
                PDWORD pvalue = (PDWORD)((UINT)buf + rofst);
                UINT offset = rofst + prel->VirtualAddress;
                *pvalue -= _imgbase.val32l;
                if (*pvalue >= _diff_ofst) {
                    *pvalue = (int)*pvalue + _diff;
                }
                *pvalue += _imgbase.val32l;
            } else if (rtype == IMAGE_REL_BASED_DIR64) {//64 bit address
                PLONGLONG pvalue = (PLONGLONG)((UINT)buf + rofst);
                UINT offset = rofst + prel->VirtualAddress;
                *pvalue -= _imgbase.val64;
                if (*pvalue >= _diff_ofst) {
                    *pvalue = (int)*pvalue + _diff;
                }
                *pvalue += _imgbase.val64;
            } else {
                if (rtype == IMAGE_REL_BASED_ABSOLUTE) {
                    a++;
                    continue;
                }
                return false;//unknown reloc type
            }
        }
        if (prel->VirtualAddress >= _diff_ofst) {
            prel->VirtualAddress = (int)prel->VirtualAddress + _diff;
        }
    }
    
    return true;
}

bool CPEResize::NormalizeImport()
{
    PIMAGE_IMPORT_DESCRIPTOR pimp;
    DWORD offset;
    int inx;
    PDWORD pvalue;
    PDWORD64 pval64;

    offset = _pdir[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
    if (!offset) {
        return true;//not need
    }

    pimp = (PIMAGE_IMPORT_DESCRIPTOR)GetDataPtr(offset, &inx);
    if (!pimp || inx < 0) {
        return false;
    }

    for (int i = 0; pimp[i].Characteristics; i++) {
        //IAT table
        if (pimp[i].FirstThunk >= _diff_ofst) {
            pimp[i].FirstThunk = (int)pimp[i].FirstThunk + _diff;
        }

        //Module name
        if (pimp[i].Name && pimp[i].Name >= _diff_ofst) {
            pimp[i].Name = (int)pimp[i].Name + _diff;
        }

        //Lookup table
        if (!_is_x64) {//x86
            pvalue = (PDWORD)GetDataPtr(pimp[i].OriginalFirstThunk, &inx);
            if (!pvalue || inx < 0) {
                return false;
            }
            for (int a = 0; pvalue[a]; a++) {
                if (pvalue[a] & 0x80000000) {
                    continue;//ignore ordinal value
                }
                if (pvalue[a] >= _diff_ofst) {
                    pvalue[a] = (int)pvalue[a] + _diff;
                }
            }
        } else {//x64
            pval64 = (PDWORD64)GetDataPtr(pimp[i].OriginalFirstThunk, &inx);
            if (!pval64 || inx < 0) {
                return false;
            }
            for (int a = 0; pval64[a]; a++) {
                if (pval64[a] & 0x8000000000000000) {
                    continue;//ignore ordinal value
                }
                if (pval64[a] >= _diff_ofst) {
                    pval64[a] = (int)pval64[a] + _diff;
                }
            }
        }
        
        if (pimp[i].OriginalFirstThunk >= _diff_ofst) {
            pimp[i].OriginalFirstThunk = (int)pimp[i].OriginalFirstThunk + _diff;
        }
    }

    return true;
}

bool CPEResize::NormalizeExport()
{
    PIMAGE_EXPORT_DIRECTORY pexp;
    DWORD offset;
    PDWORD pvalue;
    int inx;

    offset = _pdir[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
    if (!offset) {
        return true;//not need
    }

    pexp = (PIMAGE_EXPORT_DIRECTORY)GetDataPtr(offset, &inx);
    if (!pexp || inx < 0) {
        return false;
    }

    //EAT
    pvalue = (PDWORD)GetDataPtr(pexp->AddressOfFunctions, &inx);
    if (!pvalue || inx < 0) {
        return false;
    }
    for (int i = 0; i < pexp->NumberOfFunctions; i++) {
        if (pvalue[i] >= _diff_ofst) {
            pvalue[i] = (int)pvalue[i] + _diff;
        }
    }

    //Name table
    pvalue = (PDWORD)GetDataPtr(pexp->AddressOfNames, &inx);
    if (!pvalue || inx < 0) {
        return false;
    }
    for (int i = 0; i < pexp->NumberOfNames; i++) {
        if (pvalue[i] >= _diff_ofst) {
            pvalue[i] = (int)pvalue[i] + _diff;
        }
    }

    //exp dir
    if (pexp->Name >= _diff_ofst) {
        pexp->Name = (int)pexp->Name + _diff;
    }
    if (pexp->AddressOfFunctions >= _diff_ofst) {
        pexp->AddressOfFunctions = (int)pexp->AddressOfFunctions + _diff;
    }
    if (pexp->AddressOfNameOrdinals >= _diff_ofst) {
        pexp->AddressOfNameOrdinals = (int)pexp->AddressOfNameOrdinals + _diff;
    }
    if (pexp->AddressOfNames >= _diff_ofst) {
        pexp->AddressOfNames = (int)pexp->AddressOfNames + _diff;
    }
    
    return true;
}

bool CPEResize::NormalizeResource()
{
    DWORD offset = _pdir[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
    if (!offset) {
        return true;//not need
    }
    if (!RecurRCNodeNormalize(offset)) {
        return false;
    }
    return true;
}

bool CPEResize::NormalizeException()
{//need only for x64
    PIMAGE_IA64_RUNTIME_FUNCTION_ENTRY pexc;
    DWORD offset;
    int inx;

    offset = _pdir[IMAGE_DIRECTORY_ENTRY_EXCEPTION].VirtualAddress;
    if (!_is_x64 || !offset) {
        return true;
    }

    pexc = (PIMAGE_IA64_RUNTIME_FUNCTION_ENTRY)GetDataPtr(offset, &inx);
    if (!pexc || inx < 0) {
        return false;
    }

    while (pexc->BeginAddress) {
        if (pexc->BeginAddress > _diff_ofst) {
            pexc->BeginAddress = (int)pexc->BeginAddress + _diff;
        }
        if (pexc->EndAddress > _diff_ofst) {
            pexc->EndAddress = (int)pexc->EndAddress + _diff;
        }

        //TODO mb unwind
        /*PUNWIND_INFO punwnd = (PUNWIND_INFO)GetDataPtr(pexc->UnwindInfoAddress, &inx);
        if (!punwnd || inx < 0) {
            return false;
        }*/
        
        if (pexc->UnwindInfoAddress > _diff_ofst) {
            pexc->UnwindInfoAddress = (int)pexc->UnwindInfoAddress + _diff;
        }

        pexc++;
    }

    return true;
}

bool CPEResize::RecurRCNodeNormalize(DWORD dir_addr)
{
    PIMAGE_RESOURCE_DIRECTORY pdir;
    PIMAGE_RESOURCE_DIRECTORY_ENTRY pedir;
    PIMAGE_RESOURCE_DATA_ENTRY pentry;
    int inx, count;
    PBYTE sect_buf;

    pdir = (PIMAGE_RESOURCE_DIRECTORY)GetDataPtr(dir_addr, &inx);
    if (!pdir || inx < 0) {
        return false;
    }

    sect_buf = GetDataPtr(_psects[inx].VirtualAddress, &inx);
    if (!sect_buf || inx < 0) {
        return false;
    }

    count = pdir->NumberOfIdEntries + pdir->NumberOfNamedEntries;
    pedir = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((DWORD)pdir + sizeof(IMAGE_RESOURCE_DIRECTORY));
    for (int i = 0; i < count; i++) {
        if (pedir[i].NameIsString && pedir[i].NameOffset >= _diff_ofst) {
            pedir[i].NameOffset = (int)pedir[i].NameOffset + _diff;
        }

        if (pedir[i].DataIsDirectory) {
            if (!RecurRCNodeNormalize(pedir[i].OffsetToDirectory + _psects[inx].VirtualAddress)) {
                return false;
            }
        } else {
            pentry = (PIMAGE_RESOURCE_DATA_ENTRY)(pedir[i].OffsetToData + (int)sect_buf);
            if (pentry->OffsetToData >= _diff_ofst) {
                pentry->OffsetToData = (int)pentry->OffsetToData + _diff;
            }
        }
    }
}

bool CPEResize::NormalizeTls()
{
    PIMAGE_TLS_DIRECTORY32 ptls32;
    PIMAGE_TLS_DIRECTORY64 ptls64;
    DWORD offset, *pvalue, count;
    int64_t *pval64;
    int inx;

    offset = _pdir[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress;
    if (!offset || _pdir[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress) {//mb TODEL
        return true;//not need
    }

    pvalue = NULL;
    if (!_is_x64) {//x86
        ptls32 = (PIMAGE_TLS_DIRECTORY32)GetDataPtr(offset, &inx);
        if (!ptls32 || inx < 0) {
            return false;
        }

        //normalize not need with relocs
        if (!_pdir[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress) {
            //Default TLS data region
            if (ptls32->StartAddressOfRawData && ptls32->StartAddressOfRawData - _imgbase.val32l >= _diff_ofst) {
                ptls32->StartAddressOfRawData = ptls32->StartAddressOfRawData + _diff;
            }
            if (ptls32->EndAddressOfRawData && ptls32->EndAddressOfRawData - _imgbase.val32l >= _diff_ofst) {
                ptls32->EndAddressOfRawData = ptls32->EndAddressOfRawData + _diff;
            }
            //Indexes
            if (ptls32->AddressOfIndex && ptls32->AddressOfIndex - _imgbase.val32l >= _diff_ofst) {
                ptls32->AddressOfIndex = ptls32->AddressOfIndex + _diff;
            }
            //Callbacks
            if (ptls32->AddressOfCallBacks) {
                //callback table
                pvalue = (PDWORD)GetDataPtr(ptls32->AddressOfCallBacks, &inx);
                if (!pvalue || inx < 0) {
                    return false;
                }
                for (int i = 0; pvalue[i]; i++) {
                    if (pvalue[i] >= _diff_ofst) {
                        pvalue[i] = ((int)pvalue[i] - _imgbase.val32l) + _diff;
                    }
                }
                //header
                if (ptls32->AddressOfCallBacks - _imgbase.val32l >= _diff_ofst) {
                    ptls32->AddressOfCallBacks = ptls32->AddressOfCallBacks + _diff;
                }
            }
        }
    } else {//x64
        ptls64 = (PIMAGE_TLS_DIRECTORY64)GetDataPtr(offset, &inx);
        if (!ptls64 || inx < 0) {
            return false;
        }

        if (!_pdir[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress) {
            //Default TLS data region
            if (ptls64->StartAddressOfRawData && ptls64->StartAddressOfRawData - _imgbase.val64 >= _diff_ofst) {
                ptls64->StartAddressOfRawData = ptls64->StartAddressOfRawData + _diff;
            }
            if (ptls64->EndAddressOfRawData && ptls64->EndAddressOfRawData - _imgbase.val64 >= _diff_ofst) {
                ptls64->EndAddressOfRawData = ptls64->EndAddressOfRawData + _diff;
            }
            //Indexes
            if (ptls64->AddressOfIndex && ptls64->AddressOfIndex - _imgbase.val64 >= _diff_ofst) {
                ptls64->AddressOfIndex = ptls64->AddressOfIndex + _diff;
            }
            //Callbacks
            if (ptls64->AddressOfCallBacks) {
                pval64 = (int64_t *)GetDataPtr(ptls64->AddressOfCallBacks, &inx);
                if (!pval64 || inx < 0) {
                    return false;
                }
                for (int i = 0; pval64[i]; i++) {
                    if (pval64[i] >= _diff_ofst) {
                        pval64[i] = ((int)pval64[i] - _imgbase.val64) + _diff;
                    }
                }
                if (ptls64->Address/spanspan style= (prel- (!pvalue || inx color: #0000ffgt;EndAddressOfRawData = ptls32-OfCallBacks - _imgbase.val64 >= _diff_ofst) {
                    ptls64->AddressOfCallBacks = ptls64->AddressOfCallBacks + _diff;
                }
            }
        }
    }

    return true;
}

bool CPEResize::NormalizeDebug()
{
    DWORD offset = _pdir[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress;
    PIMAGE_DEBUG_DIRECTORY pdebug;
    int inx;

    if (!offset) {
        return true;//not need
    }
    pdebug = (PIMAGE_DEBUG_DIRECTORY)GetDataPtr(offset, &inx);
    if (!pdebug || inx < 0) {
        return false;
    }
    if (pdebug->AddressOfRawData >= _diff_ofst) {
        pdebug->AddressOfRawData = (int)pdebug->AddressOfRawData + _diff;
    }
    return true;
}

bool CPEResize::NormalizeConfig()
{
    PIMAGE_LOAD_CONFIG_DIRECTORY32 pcfg32;
    PIMAGE_LOAD_CONFIG_DIRECTORY64 pcfg64;
    DWORD offset, *pvalue, count;
    int inx;
    PBYTE ptr;
    UAddress imgbase;

    offset = _pdir[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].VirtualAddress;
    if (!offset) {
        return true;//not need
    }

    ptr = GetDataPtr(offset, &inx);
    if (!ptr || inx < 0) {
        return false;
    }

    pvalue = NULL;
    if (!_is_x64) {//x86
        pcfg32 = (PIMAGE_LOAD_CONFIG_DIRECTORY32)ptr;
        
        //SEH
        if (pcfg32->SEHandlerTable) {
            count = pcfg32->SEHandlerCount;

            offset = pcfg32->SEHandlerTable - _imgbase.val32l;
            pvalue = (PDWORD)GetDataPtr(offset, &inx);
            if (!pvalue || inx < 0) {
                return false;
            }

            if (!_pdir[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress && offset >= _diff_ofst) {
                pcfg32->SEHandlerTable = (int)pcfg32->SEHandlerTable + _diff;
            }
        }
        //Security cookie
        if (pcfg32->SecurityCookie && !_pdir[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress
        && pcfg32->SecurityCookie - _imgbase.val32l >= _diff_ofst) {
            pcfg32->SecurityCookie = (int)pcfg32->SecurityCookie + _diff;
        }
    } else {//x64
        pcfg64 = (PIMAGE_LOAD_CONFIG_DIRECTORY64)ptr;

        //SEH
        if (pcfg64->SEHandlerTable) {
            count = pcfg64->SEHandlerCount;

            offset = pcfg64->SEHandlerTable - _imgbase.val64;
            pvalue = (PDWORD)GetDataPtr(offset, &inx);
            if (!pvalue || inx < 0) {
                return false;
            }

            if (!_pdir[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress && offset >= _diff_ofst) {
                pcfg64->SEHandlerTable = (int64_t)pcfg64->SEHandlerTable + _diff;
            }
        }
        //Security cookie
        if (pcfg64->SecurityCookie && !_pdir[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress
        && pcfg64->SecurityCookie - _imgbase.val64 >= _diff_ofst) {
            pcfg64->SecurityCookie = (int64_t)pcfg64->SecurityCookie + _diff;
        }
    }

    //SEH
    if (pvalue) {
        for (int i = 0; i < count; i++) {
            if (pvalue[i] >= _diff_ofst) {
                pvalue[i] = (int)pvalue[i] + _diff;
            }
        }
    }

    return true;
}

bool CPEResize::NormalizeDelayImport()
{
    PIMAGE_DELAY_IMPORT_DESCRIPTOR pdelay;
    DWORD offset, *pvalue;
    DWORD64 *pval64;
    int inx;

    offset = _pdir[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT].VirtualAddress;
    if (!offset) {
        return true;//not need
    }

    pdelay = (PIMAGE_DELAY_IMPORT_DESCRIPTOR)GetDataPtr(offset, &inx);
    if (!pdelay || inx < 0) {
        return false;
    }

    for (int i = 0; ; i++) {
        if (!pdelay[i].szName) {
            break;
        }

        //IAT
        if (pdelay[i].pIAT >= _diff_ofst) {
            pdelay[i].pIAT = (int)pdelay[i].pIAT + _diff;
        }

        //Module name
        if (pdelay[i].szName >= _diff_ofst) {
            pdelay[i].szName = (int)pdelay[i].szName + _diff;
        }

        //Module handle
        if (pdelay[i].phmod >= _diff_ofst) {
            pdelay[i].phmod = (int)pdelay[i].phmod + _diff;
        }

        //Lookup table
        if (!_is_x64) {//x86
            pvalue = (PDWORD)GetDataPtr(pdelay[i].pINT, &inx);
            if (!pvalue || inx < 0) {
                return false;
            }
            for (int a = 0; pvalue[a]; a++) {
                if (pvalue[a] & 0x80000000) {
                    continue;//ignore ordinal value
                }
                if (pvalue[a] >= _diff_ofst) {
                    pvalue[a] = (int)pvalue[a] + _diff;
                }
            }
        } else {//x64
            pval64 = (PDWORD64)GetDataPtr(pdelay[i].pINT, &inx);
            if (!pval64 || inx < 0) {
                return false;
            }
            for (int a = 0; pval64[a]; a++) {
                if (pval64[a] & 0x8000000000000000) {
                    continue;//ignore ordinal value
                }
                if (pval64[a] >= _diff_ofst) {
                    pval64[a] = (int)pval64[a] + _diff;
                }
            }
        }
        if (pdelay[i].pINT >= _diff_ofst) {
            pdelay[i].pINT = (int)pdelay[i].pINT + _diff;
        }

        //Bound import
        if (pdelay[i].pBoundIAT >= _diff_ofst) {
            pdelay[i].pBoundIAT = (int)pdelay[i].pBoundIAT + _diff;
        }

        //Unload table
        if (pdelay[i].pUnloadIAT >= _diff_ofst) {
            pdelay[i].pUnloadIAT = (int)pdelay[i].pUnloadIAT + _diff;
        }
    }

    return true;
}

PBYTE CPEResize::GetDataPtr(DWORD voffset, int *sect_inx)
{//Convert virtual offset to buffer ptr
    //check offset to the header
    if (voffset < (_is_x64 ? _popt64->SizeOfHeaders : _popt32->SizeOfHeaders)) {
        if (sect_inx) {
            *sect_inx = -1;
        }
        return (PBYTE)(_pview + voffset);
    }

    //check offset to the sections data
    for (int i = 0; i < _pimg->NumberOfSections; i++) {
        if (_psects[i].SizeOfRawData > 0 && _psects[i].VirtualAddress <= voffset 
        && Aligment(_psects[i].VirtualAddress + _psects[i].Misc.VirtualSize, _aligm) > voffset) {
            if (sect_inx) {
                *sect_inx = i;
            }
            return (PBYTE)(_psects[i].PointerToRawData + (voffset - _psects[i].VirtualAddress) + _pview);
        }
    }

    return NULL;
}

UINT CPEResize::Aligment(UINT size, UINT aligm_base)
{
    UINT new_size = size;
    if (size % aligm_base != 0) {
        new_size += aligm_base - (size % aligm_base);
    }
    return new_size;
}

main.cpp

// --------------------------------------------------------------
// File : main.cpp
// This is example, how to change any section size,
// supported PE and PE+(x64)
// by JKornev <c> http://k0rnev.blogspot.com
// --------------------------------------------------------------
#include "resizer.h"
#include <stdio.h>


int main(int argc, char *argv[])
{
    unsigned int sect_num, sect_size;
    CPEResize peres;
    char back_path[MAX_PATH];

    if (argc < 4) {
        printf("Error, incorrect arguments!\n"
            "Format: resize.exe \"pe file name\" section_num new_size\n");
        return 1;
    }

    sect_num = atoi(argv[2]);//0, 1, ...
    sect_size = atoi(argv[3]);

    //make backup
    sprintf(back_path, "%s.back", argv[1]);
    if (!CopyFileA(argv[1], back_path, false)) {
        printf("Error, can't create backup %d\n", GetLastError());
        return 1;
    }

    if (!peres.OpenModule(argv[1])) {
        printf("Error, can't open module!\n");
        return 1;
    }

    if (!peres.ChangeSectorSize(sect_num, sect_size)) {
        printf("Error, can't resize section!\n");
    }
    peres.CloseModule();

    return 0;
}

3 комментария:

Unknown25 мая 2015 г. в 18:18
Привет !
Я тоже занимался, и еще буду, написанием (перемещаемой) PE-библиотеки (на masm), ориентированной на использование в вирусах.
Вот имена функций, отображающих идеологию библиотеки (состоящей из одного файла Functions.Pe.M.asm):

; 2.5 Анализа PE-файлов: PeCheckFormatSimpleM(2)
; PeFindDescriptorOfSectionByNCDAM(6)
; 2.6 Анализа/модификации PE-файлов: PeIncreaseSectionAndShiftUpGroupM(6), PeAdditionAPIInImportTableM(6), PeAdditionSectionInEndM(8)
; PeDeleteSectionByNCDM(4), PeRebuildingResourceM(x), PeRelocationM(3)

Прототипы:

;[1] Функции анализа PE-файлов.

; PeCheckFormatSimpleM(
; DWORD pinMapViewOfFile
; DWORD CheckRead512_pNT_HEADERS
; DWORD PE32or64
; )
; out:
; eax - причина завершениЯ
; PeFindDescriptorOfSectionByNCDAM(
; DWORD pinTableOfSections
; DWORD NumberOfSections
; DWORD N_C_D_A
; DWORD pinNSectOrCSectOrIntRVA
; DWORD RVADirectory
; DWORD sbDirectory
; )
; out:
; eax - VA или причина завершениЯ

;[2] Функции анализа/модификации PE-файлов.

; PeIncreaseSectionAndShiftUpGroupM( PeAdditionAPIInImportTableM( PeAdditionSectionInEndM(
; DWORD pinoutMapViewOfFile (out) DWORD pinoutMapViewOfFile (out) DWORD pinoutMapViewOfFile (out)
; DWORD sbMapViewOfFile DWORD sbMapViewOfFile DWORD sbMapViewOfFile
; DWORD pShiftBegin (!) DWORD sbGetFileSize DWORD sbGetFileSize
; DWORD sbShiftData (!) DWORD pfuncIncreaseAndShift DWORD pfuncIncreaseAndShift
; DWORD sbInsertData (!) DWORD pinSetOfStrings (!) DWORD pinBuffer (!)
; DWORD byte (!) DWORD poutArrayOfJmpsPatchs (!) (out) DWORD sbBuffer (!)
; ) ) DWORD pinNSect (!)
; out:edx - VA DWORD IAT <-> LoadLibrary DWORD Characteristics (!)
; edi - VA DWORD IAT <-> GetProcAddress )
; out: out: out:
; eax - причина завершениЯ eax - причина завершениЯ eax - причина завершениЯ
; ebx - дополн. возвращаемое значение ebx - VA добавленной секции в ПП, если eax=1
; ecx - добавочный размер ФО, если eax=1 ecx - VA добавленной секции в ВО, если eax=1
;
; PeDeleteSectionByNCDM( PeRebuildingResourceM( PeRelocationM(
; DWORD pinoutMapViewOfFile (out) DWORD pinDescriptorOfSrsrc DWORD pinoutMapViewOfFile (out)
; DWORD sbMapViewOfFile DWORD pinDescriptorOfDrsrc DWORD sbMapViewOfFile
; DWORD N_C_D DWORD RVASrsrcNew DWORD ImageBaseNew
; DWORD pinNSectOrCSectOrNumberDir DWORD pinoutBuffer )
; ) )
; out: out: out:
; eax - причина завершениЯ eax - причина завершениЯ eax - причина завершениЯ
ОтветитьУдалить
Ответы

Добавить комментарий

Way of researcher

Страницы

понедельник, 2 декабря 2013 г.

Изменение размера произвольной секций PE файла

3 комментария:

Архив блога

Ярлыки

Полезные ссылки

Постоянные читатели

Страницы

понедельник, 2 декабря 2013 г.

Изменение размера произвольной секций PE файла

3 комментария:

Архив блога

Ярлыки

Полезные ссылки

Постоянные читатели

понедельник, 2 декабря 2013 г.