PE伪装器介绍

时间:2010-01-30 12:19:00  来源:第二电脑网  作者:第二电脑网

  第二电脑网导读:。只是代码中有几个数据结构可能是平时极少用到的,都是用来存放PE结构的变量。大家可以参考PE结构方面的资料。(其实看名字应该也能猜出个十有八九)注释我懒得写了,有问题直接跟贴。unit Unit1;
  正文:这个是修改PE头骗过PEID的小工具。也就是大家通常所说的给程序添加花指令。原理非常简单,就是给EXE文件加一个PE头,然后写我们的“花指令”。如果你读懂过jingtao的“谈Delphi编程中流的应用”那篇文章的话。相信对这段代码不会陌生,因为这基础原理是一样的。只是代码中有几个数据结构可能是平时极少用到的,都是用来存放PE结构的变量。大家可以参考PE结构方面的资料。(其实看名字应该也能猜出个十有八九)注释我懒得写了,有问题直接跟贴。


unit Unit1;

interface

uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, ExtCtrls, StdCtrls;

type
TForm1 = class(TForm)
Label1: TLabel;
Edit1: TEdit;
Button1: TButton;
Bevel1: TBevel;
Button3: TButton;
OpenDialog1: TOpenDialog;
procedure FormCreate(Sender: TObject);
procedure Button1Click(Sender: TObject);
procedure Button3Click(Sender: TObject);
procedure obtain;
private
{ Private declarations }
FImageBase: Dword;
public
{ Public declarations }
end;

THEAD = array[0..63] of byte;

var
Form1: TForm1;

const
MYSECTION = 'Fi7ke';  //添加的节名,自定义
  JMPOFF = 43;  //花指令的机器码,Ollydbg加载后随便取
  OEPCODE: THEAD = ($55, $8B, $EC, $6A, $FF, $68, $2A, $2C, $0A, $00, $68, $38,
$90, $0D, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89,
$25, $00, $00, $00, $00, $58, $64, $A3, $00, $00, $00, $00,
$58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF,
$E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,
$00, $00, $00, $00);

procedure AddSection(FName: string);

implementation

{$R *.dfm}

procedure AddSection(FName: string);
var
DOSHEADER: IMAGE_DOS_HEADER;
PEHEADER: IMAGE_NT_HEADERS;
SectionHeader: IMAGE_SECTION_HEADER;
MySectionHeader: IMAGE_SECTION_HEADER;
fs: TFileStream;
AddressOfEntryPoint: DWORD;
begin
  fs := TFileStream.Create(FName, fmOpenReadWrite +
  fmShareDenyWrite);
  try
    fs.Seek(0, soFromBeginning);
    fs.Read(DOSHEADER, sizeof(DOSHEADER));
    
    fs.Seek(DOSHEADER._lfanew, soFromBeginning);
    fs.Read(PEHEADER, sizeOf(PEHEADER));
    
    fs.Seek(sizeOf(SectionHeader) *
    (PEHEADER.FileHeader.NumberOfSections - 1), soFromCurrent);
    
    fs.Read(SectionHeader, sizeof(IMAGE_SECTION_HEADER));
    
    MySectionHeader.Name[0] := ord('F');
    MySectionHeader.Name[1] := ord('i');
    MySectionHeader.Name[2] := ord('7');
    MySectionHeader.Name[3] := ord('k');
    MySectionHeader.Name[4] := ord('e');
    MySectionHeader.Name[5] := 0;
    MySectionHeader.Name[6] := 0;
    MySectionHeader.Name[7] := 0;
    
    MySectionHeader.VirtualAddress := PEHEADER.OptionalHeader.SizeOfImage;
    MySectionHeader.Misc.VirtualSize := $200;
    MySectionHeader.SizeOfRawData := (MySectionHeader.VirtualAddress div
    PEHEADER.OptionalHeader.FileAlignment + 1) * PEHEADER.OptionalHeader.FileAlignment -
    PEHEADER.OptionalHeader.SizeOfImage;
    MySectionHeader.PointerToRawData :=
    SectionHeader.SizeOfRawData + SectionHeader.PointerToRawData;
    MySectionHeader.Characteristics := $E0000020;
    
    Inc(PEHEADER.FileHeader.NumberOfSections);
    fs.Write(MySectionHeader, sizeOf(MySectionHeader));
    
    fs.Seek(DOSHEADER._lfanew, soFromBeginning);
    
    AddressOfEntryPoint := PEHEADER.OptionalHeader.AddressOfEntryPoint;
    
    PEHEADER.OptionalHeader.AddressOfEntryPoint :=
    MySectionHeader.VirtualAddress;
    
    PEHEADER.OptionalHeader.MajorLinkerVersion := 7;
    PEHEADER.OptionalHeader.MinorLinkerVersion := 0;
    AddressOfEntryPoint := AddressOfEntryPoint +
    PEHEADER.OptionalHeader.ImageBase;
    
    asm   //这里说明一下,这是嵌入的汇编代码,寄存器—CPU暂时储存数据的东西,比内存更快,以提高效率

PE伪装器介绍》由第二电脑网原创提供,转载请注明:http://www.002pc.com/master/College/Language/Delphi/12662.html


关键字:

关于《PE伪装器介绍》文章的评论

站内搜索: 高级搜索

热门搜索: Windows style 系统 tr IP QQ CPU 安装 function 注册 if td