1625-5 Wang Ziang summarized "March 20, 2018" [Summary for the 535th consecutive day]
A. Secondary development of the code (2)
B.
Building blocks by hand
The space size of the block gap is limited. If the required code is not much, the above method is convenient and fast. But if you need to add a lot of code, the block gap is not enough. Blocks must be added manually at this point.
Manual construction of blocks must be familiar with the PE format, and tools are generally available for practical operation.
There are three main tasks to be done:
1. Increase the block header
2. Increase the data segment pointed to by the block header
3. Adjust the image size in the file header
When constructing blocks, you must pay attention to the alignment of the blocks. If it is not aligned, an error may be reported on some systems.
- Modify the block table The
block table is composed of a series of IMAGE_SECTION_HEADER structures after the PE file header.
Each structure describes a block, and the order of the structures is the same as the order of the blocks in the file. The
block table ends with an empty structure logo
If you want to add a new section, you need to add a block
header and fill in the attributes as needed.
Pay attention to the problem of block alignment.
2. Add data segment.
With the block header, you need to add content to the block.
Insert at the end of the file 0x1000h size data block is enough
Tool Aid Building Blocks
When actually adding a block, because it is cumbersome, it is generally done quickly with a tool. Open the file
with LordPE, and on the block list, execute the add section header function in the right-click menu to add a block. Check 'autofix SizeOfImage' to automatically fix the image size value. However, the content of the data segment still needs to be added by yourself.
The CFF Explorer is more complete and can automatically increase the corresponding data segment
Precautions
Generally, the block table of the software PE header is followed by a space of all 0s (used to align the following blocks), so the new block will not destroy the file
, but sometimes the block table just fills the alignment unit. , or something else behind it. At this point, it is not very convenient to add block headers.
In theory, it should be possible to correct the offset behind, but the amount of work is a bit large. 233
C. Tomorrow plan
Get function call