<原创>在PE最后一节中插入补丁程序（附代码）

完整文件  http://files.cnblogs.com/Files/Gotogoo/在PE最后一节中插入补丁程序.zip

在PE文件最后一节中插入补丁程序，是最简单也是最有效的一种，因为PE最后一节的数据在文件的末尾，将代码加到最后一节时，不需要修改太多的内容。

最近在学习python，没时间详细写这个了，有问题看代码，或者在评论区提问，或者看书《Windows PE权威指南》，讲的很详细。

 #include "stdafx.h"
 #include<Windows.h>

 char szTargetPath[MAX_PATH]  = "D:\\Target.exe";          //目标文件的路径
 char szPatchPath[MAX_PATH]   = "D:\\helloworld_1.exe";    //补丁文件的路径
 char szModifyPEPath[MAX_PATH]= "D:\\Modified_PE.exe";     //修改后生成新文件的路径
 enum PATCH_FILE_INFO
 {
     FileAlignSectionSize,
     RealSectionSize,
     SectionRVA,
     AddressOfEntryPoint,
     FileAlignment
 };

 PVOID GetFileBaseAddressAndSize(char* szFilePath,PULONG ulFileSize );
 BOOL InsertPatchFileToTargetFile(PVOID lpTargetMemory,PVOID lpPatchMemory,ULONG ulTargetSize);
 DWORD GetFileInfo(PVOID FileBaseAddress,PATCH_FILE_INFO Type);
 VOID ModifyParameter(PVOID FileBaseAddress,ULONG ulTargetSize,ULONG ulFlieAlignPatchCodeSize,ULONG ulRealPatchCodeSize,ULONG ulNewOEP);
 ULONG GetPathCodeSectionRVA(PVOID lpPatchMemory);
 ULONG Align(ULONG FileSize,ULONG ulAlignment);
 ULONG FileAlign(ULONG FileSize,ULONG ulFileAlignment);
 ULONG GetNewFileOEP(PVOID lpTargetMemory);
 VOID ModifyPatchCodeJumpAddress(PVOID lpNewFileBaseAddress,ULONG NewFileSize,ULONG ULNewFileOEP,ULONG ulOldOEP,ULONG ulRealPatchCodeSize);

 int _tmain(int argc, _TCHAR* argv[])
 {
     PVOID lpPatchMemory  = NULL;
     PVOID lpTargetMemory = NULL;
     ULONG ulPatchSize    = ;
     ULONG ulTargetSize   = ;

     lpTargetMemory = GetFileBaseAddressAndSize(szTargetPath,&ulTargetSize);
     lpPatchMemory  = GetFileBaseAddressAndSize(szPatchPath,&ulPatchSize);

     InsertPatchFileToTargetFile(lpTargetMemory,lpPatchMemory,ulTargetSize);

     return ;
 }

 BOOL InsertPatchFileToTargetFile(PVOID lpTargetMemory,PVOID lpPatchMemory,ULONG ulTargetSize)
 {
     DWORD dwFileAlignPatchCodeSize = ;
     DWORD dwRealPatchCodeSize      = ;
     ULONG ulPathCodeSectionRVA     = ;
     ULONG ULNewFileOEP             = ;
     ULONG ulOldOEP                 = ;
     ULONG ulFileAlignment          = ;

     dwRealPatchCodeSize      = GetFileInfo(lpPatchMemory,RealSectionSize);        //获得Patch文件未对齐时的大小
     ulPathCodeSectionRVA     = GetFileInfo(lpPatchMemory,SectionRVA);              //获得Patch文件所要加载节的RVA
     ulOldOEP                 = GetFileInfo(lpTargetMemory,AddressOfEntryPoint);
     ulFileAlignment          = GetFileInfo(lpTargetMemory,FileAlignment);
     ULNewFileOEP             = GetNewFileOEP(lpTargetMemory);
     dwFileAlignPatchCodeSize = Align(dwRealPatchCodeSize,ulFileAlignment);

     PVOID NewFileBaseAddress = malloc(ulTargetSize+dwFileAlignPatchCodeSize);
     memset(NewFileBaseAddress,,ulTargetSize+dwFileAlignPatchCodeSize);

     memcpy(NewFileBaseAddress,lpTargetMemory,ulTargetSize);
     memcpy((PVOID)((ULONG_PTR)NewFileBaseAddress+ulTargetSize),(PVOID)((ULONG_PTR)lpPatchMemory+ulPathCodeSectionRVA),dwRealPatchCodeSize);

     ModifyPatchCodeJumpAddress(NewFileBaseAddress,ulTargetSize+dwRealPatchCodeSize,ULNewFileOEP,ulOldOEP,dwRealPatchCodeSize);   //修改PatchCode结尾E9跳转地址

     ModifyParameter(NewFileBaseAddress,ulTargetSize,dwFileAlignPatchCodeSize,dwRealPatchCodeSize,ULNewFileOEP);                  //修改最后一节和PE头的参数

     HANDLE hNewFile = CreateFileA(szModifyPEPath,GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_ARCHIVE,NULL);
     if(hNewFile == INVALID_HANDLE_VALUE)
     {
         printf("CreateFileA Failed！\r\n");
         return FALSE;
     }
     DWORD dwRet = ;
     if(WriteFile(hNewFile,NewFileBaseAddress,ulTargetSize+dwFileAlignPatchCodeSize,&dwRet,NULL) == )
     {
         printf("WriteFile Failed！\r\n");
         return FALSE;
     }
     else
     {
         printf("Succeed！\r\n");
     }

     return TRUE;

 }
 ULONG GetNewFileOEP(PVOID lpTargetMemory)
 {
     PIMAGE_DOS_HEADER DosHead         = (PIMAGE_DOS_HEADER)lpTargetMemory;
     PIMAGE_NT_HEADERS NTHead          = (PIMAGE_NT_HEADERS)((ULONG_PTR)DosHead+DosHead->e_lfanew);
     PIMAGE_SECTION_HEADER SectionHead = (PIMAGE_SECTION_HEADER)((ULONG_PTR)NTHead+sizeof(IMAGE_NT_HEADERS));

     ULONG ulNumberOfSection = NTHead->FileHeader.NumberOfSections;
     ULONG ulNewFileOEP      = SectionHead[ulNumberOfSection-].VirtualAddress+SectionHead[ulNumberOfSection-].SizeOfRawData;
     return ulNewFileOEP;
 }
 VOID ModifyPatchCodeJumpAddress(PVOID lpNewFileBaseAddress,ULONG NewFileSize,ULONG ULNewFileOEP,ULONG ulOldOEP,ULONG ulRealPatchCodeSize)
 {
     UCHAR JmpCode[] = "\x00\x00\x00\x00";
     *(int*)JmpCode  = ( ulOldOEP + ) -  ( ULNewFileOEP + ulRealPatchCodeSize );                        //+1越过E9
     memcpy((PVOID)((UCHAR*)lpNewFileBaseAddress + NewFileSize - ),JmpCode,strlen((char*)JmpCode));    //看内存  E9后有5个非0字节，所以不是-4

 }

 VOID ModifyParameter(PVOID FileBaseAddress,ULONG ulTargetSize,ULONG ulFlieAlignPatchCodeSize,ULONG ulRealPatchCodeSize,ULONG ulNewOEP)
 {
     PIMAGE_DOS_HEADER DosHead         = (PIMAGE_DOS_HEADER)FileBaseAddress;
     PIMAGE_NT_HEADERS NTHead          = (PIMAGE_NT_HEADERS)((ULONG_PTR)DosHead+DosHead->e_lfanew);
     PIMAGE_SECTION_HEADER SectionHead = (PIMAGE_SECTION_HEADER)((ULONG_PTR)NTHead+sizeof(IMAGE_NT_HEADERS));

     ULONG MemoryAlignment   = NTHead->OptionalHeader.SectionAlignment;
     ULONG ulNumberOfSection = NTHead->FileHeader.NumberOfSections;

     SectionHead[ulNumberOfSection-].Characteristics   = 0x60000020;
     SectionHead[ulNumberOfSection-].Misc.VirtualSize  = SectionHead[ulNumberOfSection-].SizeOfRawData + ulRealPatchCodeSize;
     SectionHead[ulNumberOfSection-].SizeOfRawData    += ulFlieAlignPatchCodeSize;

     NTHead->OptionalHeader.SizeOfImage =  Align(SectionHead[ulNumberOfSection-].VirtualAddress+SectionHead[ulNumberOfSection-].SizeOfRawData,MemoryAlignment);
     NTHead->OptionalHeader.AddressOfEntryPoint = ulNewOEP;
 }

 ULONG Align(ULONG FileSize,ULONG ulAlignment)
 {
     if(FileSize%ulAlignment != )
     {
         int Temp = FileSize/ulAlignment;
         return ulAlignment*(Temp+);
     }
     else
     {
         return FileSize;
     }
 }
 DWORD GetFileInfo(PVOID FileBaseAddress,PATCH_FILE_INFO Type)
 {
     PIMAGE_DOS_HEADER DosHead = (PIMAGE_DOS_HEADER)FileBaseAddress;
     PIMAGE_NT_HEADERS NTHead  = (PIMAGE_NT_HEADERS)((ULONG_PTR)DosHead+DosHead->e_lfanew);
     PIMAGE_SECTION_HEADER SectionHead = (PIMAGE_SECTION_HEADER)((ULONG_PTR)NTHead+sizeof(IMAGE_NT_HEADERS));

     DWORD dwEntryPoint = NTHead->OptionalHeader.AddressOfEntryPoint;
     DWORD dwRet = ;
     if(Type == AddressOfEntryPoint)
     {
         dwRet = dwEntryPoint;
     }
     if(Type == FileAlignment)
     {
         dwRet = NTHead->OptionalHeader.FileAlignment;
     }

     for(int i=;i<NTHead->FileHeader.NumberOfSections;i++)
     {
         if(dwEntryPoint>=SectionHead[i].VirtualAddress && dwEntryPoint<SectionHead[i].VirtualAddress+SectionHead[i].SizeOfRawData)
         {

             if(Type == RealSectionSize)
             {
                 dwRet = SectionHead[i].Misc.VirtualSize;
             }
             if(Type == SectionRVA)
             {
                 dwRet = SectionHead[i].PointerToRawData;
             }                    

         }    

     }

     if(dwRet == NULL)
     {
         printf("GetFileInfo Failed！\r\n");
     }

     return dwRet;

 }

 PVOID GetFileBaseAddressAndSize(char* szFilePath,PULONG ulFileSize )
 {
     HANDLE hFile = CreateFileA(szFilePath,
         GENERIC_READ|GENERIC_WRITE,FILE_SHARE_WRITE|FILE_SHARE_WRITE,NULL,
         OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);

     if (hFile==INVALID_HANDLE_VALUE)
     {
         printf("CreateFile Failed！\r\n");
         return NULL;
     }
     *ulFileSize  = GetFileSize(hFile,NULL);

     if (!(*ulFileSize))
     {
         printf("GetFileSize Failed！\r\n");
         CloseHandle(hFile);
         return NULL;
     }
     HANDLE hMapFile = CreateFileMapping(
         hFile,
         NULL,
         PAGE_READWRITE,
         ,
         ,
         NULL);

     if (hMapFile == INVALID_HANDLE_VALUE)
     {
         printf("CreateFileMapping Failed！\r\n");
         CloseHandle(hFile);
         return NULL;
     }

     PVOID FileBaseAddress = MapViewOfFile(hMapFile,FILE_MAP_ALL_ACCESS,NULL,NULL,NULL);
     if (FileBaseAddress == NULL)
     {
         CloseHandle(hFile);
         CloseHandle(hMapFile);
         printf("MapViewOfFile Failed！\r\n");
         return NULL;
     }

     return FileBaseAddress;
 }