参考:http://www.mouseos.com/assembly/06.html

参考:http://www.cnblogs.com/tk091/archive/2012/04/18/2456174.html

typedef struct CV_INFO_PDB70
{
    DWORD CvSignature;
    GUID Guid;
    DWORD Age;
    //BYTE PdbFileName[];
    char PdbFilePath[MAX_PATH];
} CV_INFO_PDB70_T;

static const DWORD g_dwTimeStamp = 0x52C652E0;

// 一共有3个地方要replace
int _tmain(int argc, _TCHAR* argv[])
{
    if (argc < 3 || _tcscmp(argv[1], _T("-m")) != 0)
    {
        printf("cmdline format err.\n");
        return 0;
    }

_tprintf(_T("---------------\nprocess file %s.\n"), argv[2]);

FILE *fp;
    fp = _tfopen(argv[2], _T("rb+"));
    if (!fp)
    {
        printf("occur error -1,reason:%d\n", errno);
        return -1;
    }

// IMAGE_NT_HEADER address
    LONG e_lfanew;
    fseek(fp, 0x3c, SEEK_SET);
    fread(&e_lfanew, 4, 1, fp);

// Signature
    DWORD sign;
    fseek(fp, e_lfanew, SEEK_SET);
    fread(&sign, 4, 1, fp);
    if (sign != 0x00004550)
    {
        printf("PE header not matched,sign:%x\n---------------\n", sign);
        fclose(fp);
        return -2;
    }

// IMAGE_FILE_HEADER
    IMAGE_FILE_HEADER ifh;
    fseek(fp, e_lfanew + 4, SEEK_SET);
    fread(&ifh, sizeof(IMAGE_FILE_HEADER), 1, fp);

#ifdef _DEBUG
    printf("IMAGE_FILE_HEADER结构:\n");
    printf("Machine       : %04X\n", ifh.Machine);
    printf("NumberOfSections  : %04X\n", ifh.NumberOfSections);
    printf("TimeDateStamp    : %08X\n", ifh.TimeDateStamp);
    printf("PointerToSymbolTable : %08X\n", ifh.PointerToSymbolTable);
    printf("NumberOfSymbols   : %08X\n", ifh.NumberOfSymbols);
    printf("SizeOfOptionalHeader : %04X\n", ifh.SizeOfOptionalHeader);
    printf("Characteristics   : %04X\n", ifh.Characteristics);
    printf("\n");
#endif

// replace timestamp
    _tprintf(_T("replace %s timestamp,old : %08X, new : %08X.\n"), argv[2], ifh.TimeDateStamp, g_dwTimeStamp);
    ifh.TimeDateStamp = g_dwTimeStamp;
    fseek(fp, e_lfanew + 4, SEEK_SET);
    fwrite((void *)&ifh, sizeof(ifh), 1, fp);

// IMAGE_DIRECTORY_ENTRY_DEBUG
    LONG debugEntryAddr = e_lfanew + 4 + sizeof(IMAGE_FILE_HEADER) + ifh.SizeOfOptionalHeader + (-10) * (long)sizeof(IMAGE_DATA_DIRECTORY);
    fseek(fp, debugEntryAddr, SEEK_SET);

// IMAGE_DATA_DIRECTORY
    IMAGE_DATA_DIRECTORY idd;
    fread(&idd, sizeof(IMAGE_DATA_DIRECTORY), 1, fp);

#ifdef _DEBUG
    printf("IMAGE_DIRECTORY_ENTRY_DEBUG结构:\n");
    printf("VirtualAddress : %08X\n", idd.VirtualAddress);
    printf("Size   : %08X\n", idd.Size);
    printf("IMAGE_DEBUG_DIRECTORY一共有%f个\n", 1.0 * idd.Size / sizeof(IMAGE_DEBUG_DIRECTORY));
    printf("\n");
#endif

// check the address valid or not
    if (idd.VirtualAddress == 0x00 || idd.Size == 0x00)
    {
        _tprintf(_T("Debug information not found in file %s, skip modify debug info.\n---------------\n"), argv[2]);
        fclose(fp);
        return 0;
    }

// IMAGE_DEBUG_DIRECTORY
    IMAGE_DEBUG_DIRECTORY idd2;
    fseek(fp, (WORD)idd.VirtualAddress, SEEK_SET); // need convert virtual address
    fread(&idd2, sizeof(IMAGE_DEBUG_DIRECTORY), 1, fp);

#ifdef _DEBUG
    printf("IMAGE_DEBUG_DIRECTORY结构:\n");
    printf("AddressOfRawData : %08X\n", idd2.AddressOfRawData);
    printf("Characteristics : %08X\n", idd2.Characteristics);
    printf("MajorVersion : %08X\n", idd2.MajorVersion);
    printf("MinorVersion : %08X\n", idd2.MinorVersion);
    printf("PointerToRawData : %08X\n", idd2.PointerToRawData);
    printf("SizeOfData : %08X\n", idd2.SizeOfData);
    printf("TimeDateStamp : %08X\n", idd2.TimeDateStamp);
    printf("Type : %08X\n", idd2.Type);
    printf("\n");
#endif

// replace timestamp
    _tprintf(_T("replace pdb timestamp, old : %08X, new : %08X.\n"), idd2.TimeDateStamp, g_dwTimeStamp);
    idd2.TimeDateStamp = g_dwTimeStamp;
    fseek(fp, (WORD)idd.VirtualAddress, SEEK_SET); // need convert virtual address
    fwrite((void *)&idd2, sizeof(idd2), 1, fp);

// CV_INFO_PDB70
    CV_INFO_PDB70_T cvInfo;
    fseek(fp, idd2.PointerToRawData, SEEK_SET);
    fread(&cvInfo, sizeof(CV_INFO_PDB70_T), 1, fp);

#ifdef _DEBUG
    printf("CV_INFO_PDB70结构:\n");
    printf("Age : %04X\n", cvInfo.Age);
    printf("CvSignature : %04X\n", cvInfo.CvSignature);
    printf("PdbFileName : %s\n", cvInfo.PdbFilePath);
    printf("Guid : %08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X\n",
        cvInfo.Guid.Data1, cvInfo.Guid.Data2, cvInfo.Guid.Data3,
        cvInfo.Guid.Data4[0], cvInfo.Guid.Data4[1], cvInfo.Guid.Data4[2],
        cvInfo.Guid.Data4[3], cvInfo.Guid.Data4[4], cvInfo.Guid.Data4[5],
        cvInfo.Guid.Data4[6], cvInfo.Guid.Data4[7]);
    printf("\n");
#endif

if (cvInfo.CvSignature != 0x53445352)   //RSDS
    {
        printf("pdb signature not matched, CvSignature:%x\n---------------\n", cvInfo.CvSignature);
        fclose(fp);
        return -2;
    }

// replace guid
    printf("replace pdb guid,old : %08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X\n",
        cvInfo.Guid.Data1, cvInfo.Guid.Data2, cvInfo.Guid.Data3, cvInfo.Guid.Data4[0],
        cvInfo.Guid.Data4[1], cvInfo.Guid.Data4[2], cvInfo.Guid.Data4[3], cvInfo.Guid.Data4[4],
        cvInfo.Guid.Data4[5], cvInfo.Guid.Data4[6], cvInfo.Guid.Data4[7]);
    //_tprintf(_T("replace pdb guid,old : %08X-%04X-%04X-%llX\n"), cvInfo.Guid.Data1, cvInfo.Guid.Data2, cvInfo.Guid.Data3, (__int64)cvInfo.Guid.Data4);
    __int64 tmp = 0xdc38466dca416db1;
    cvInfo.Guid.Data1 = 0xf363bf77;
    cvInfo.Guid.Data2 = 0xb00b;
    cvInfo.Guid.Data3 = 0x4fb0;
    memcpy(&cvInfo.Guid.Data4, &tmp, 8);

//_tprintf(_T("replace pdb guid,new : %08X-%04X-%04X-%llX\n"), cvInfo.Guid.Data1, cvInfo.Guid.Data2, cvInfo.Guid.Data3, tmp);
    printf("replace pdb guid,new : %08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X\n",
        cvInfo.Guid.Data1, cvInfo.Guid.Data2, cvInfo.Guid.Data3, cvInfo.Guid.Data4[0],
        cvInfo.Guid.Data4[1], cvInfo.Guid.Data4[2], cvInfo.Guid.Data4[3], cvInfo.Guid.Data4[4],
        cvInfo.Guid.Data4[5], cvInfo.Guid.Data4[6], cvInfo.Guid.Data4[7]);
    fseek(fp, idd2.PointerToRawData, SEEK_SET);
    fwrite((void *)&cvInfo, sizeof(cvInfo), 1, fp);

fclose(fp);

printf("---------------\n");
    //system("pause");
    getchar();

return 0;
}

Make the PE file consistent when code not changed的更多相关文章

  1. PE File.

    Figure 1 - PE File The CLR header stores information to indicate that the PE file is a .NET executab ...

  2. Delphi : Analyze PE file headers?

    Analyze PE file headers? { You'll need a OpenDialog to open a Exe-File and a Memo to show the file i ...

  3. Inject shellcode into PE file

    先声明这是不免杀的,只是演示. 哔哩哔哩视频 新增节 一般能实现特定功能的shellcode的长度都比较长,可以分到几个节上的空白区,但是这样麻烦啊,或者把最后一个节扩大,但是最后一个节一般没有执行的 ...

  4. 《Peering Inside the PE: A Tour of the Win32 Portable Executable File Format》阅读笔记二

    Common Sections The .text section is where all general-purpose code emitted by the compiler or assem ...

  5. dnSpy PE format ( Portable Executable File Format)

    Portable Executable File Format PE Format  微软官方的 What is a .PE file in the .NET framework? [closed] ...

  6. PE Header and Export Table for Delphi

    Malware Analysis Tutorial 8: PE Header and Export Table 2. Background Information of PE HeaderAny bi ...

  7. Reverse Core 第二部分 - 13章 - PE文件格式

    @date: 2016/11/24 @author: dlive ​ PE (portable executable) ,它是微软在Unix平台的COFF(Common Object File For ...

  8. 利用PE数据目录的导入表获取函数名及其地址

    PE文件是以64字节的DOS文件头开始的(IMAGE_DOS_HEADER),接着是一段小DOS程序,然后是248字节的 NT文件头(IMAGE_NT_HEADERS),NT的文件头位置由IMAGE_ ...

  9. Load PE from memory(反取证)(未完)

      Article 1:Loading Win32/64 DLLs "manually" without LoadLibrary() The most important step ...

随机推荐

  1. requests库 cookie和session

    cookie 如果一个相应中包含了cookie,那么可以利用cookie属性拿到这个返回的cookie值: res = requests.get('http://www.baidu.com') pri ...

  2. GO判断输入

    判断用户密码输入: package main import"fmt" func main(){ var a int var b int fmt.Printf("请输入密码 ...

  3. 8.Memcache

    1.概述 (1) Memcached是什么 Memcached是一款开源的.高性能的.分布式的内存对象缓存系统 (2) Memcached能干什么 最主要的功能就是:在内存中缓存数据,以减轻数据库负载 ...

  4. ssh_crm项目

    1.代码 https://pan.baidu.com/s/1hudAhA8  密码:c7xu 2.总结 https://pan.baidu.com/s/1o9ArFf0 密码:hteu 3.资料 ht ...

  5. list.Except()

    差集 List<string> list = new List<string>() { ", ", ", }; List<string> ...

  6. APNs推送的系统做法

    1. #pragma mark - 远程推送注册获得device Token if (IOS_VERSION >= 10.0) { UNUserNotificationCenter * cent ...

  7. Lesson 13 The search for oil

    What do oilmen want to achieve as soon as they strike oil? The deepest holes of all are made for oil ...

  8. 吴裕雄--天生自然python爬虫:使用requests模块的get和post方式抓取中国旅游网站和有道翻译网站翻译内容数据

    import requests url = 'http://www.cntour.cn/' strhtml = requests.get(url) print(strhtml.text) URL='h ...

  9. #define 和 const

    来自:牛客网参考解析 1.const定义常量是有数据类型的,而#define宏定义常量却没有2.const常量有数据类型,而宏常量没有数据类型.编译器可以对const进行类型安全检查,   而对后者只 ...

  10. HTML有2种路径的写法:绝对路径和相对路径

    HTML有2种路径的写法:绝对路径和相对路径 2016年11月30日 17:51:20 Bolon0708 阅读数 21775   版权声明:本文为博主原创文章,未经博主允许不得转载. https:/ ...