Windows逆向项目-LoadPE

// DlgDirectory.cpp: 实现文件 // #include "pch.h" #include "LoadPE.h" #include "afxdialogex.h" #include "DlgDirectory.h" #include"DlgExport.h" #include"PE.h" #include"DlgImport.h" #include"DlgResource.h" extern PE g_PEstru; // DlgDirectory 对话框 IMPLEMENT_DYNAMIC(DlgDirectory, CDialogEx) DlgDirectory::DlgDirectory(CWnd* pParent /*=nullptr*/) : CDialogEx(IDD_DIALOG_DIRECTORY, pParent) , m_strImport_Size(_T("")) , m_strImport_RVA(_T("")) , m_strLoadConfig_RVA(_T("")) , m_strLoadConfig_Size(_T("")) , m_strRelocation_RVA(_T("")) , m_strRelocation_Size(_T("")) , m_strReserved_RVA(_T("")) , m_strReserved_Size(_T("")) , m_strResource_RVA(_T("")) , m_strResource_Size(_T("")) , m_strSecurity_RVA(_T("")) , m_strSecurity_Size(_T("")) , m_strTls_RVA(_T("")) , m_strTls_Size(_T("")) , m_strIAT_RVA(_T("")) , m_strIAT_Size(_T("")) , m_strBoundImport_RVA(_T("")) , m_strBoundImport_Size(_T("")) , m_strCom_RVA(_T("")) , m_strCom_Size(_T("")) , m_strCopyight_RVA(_T("")) , m_strCopyight_Size(_T("")) , m_strDebug_RVA(_T("")) , m_strDebug_Size(_T("")) , m_strDelayImport_RVA(_T("")) , m_strDelayImport_Size(_T("")) , m_strException_RVA(_T("")) , m_strException_Size(_T("")) , m_strExport_RVA(_T("")) , m_strExport_Size(_T("")) , m_strGlobalptr_RVA(_T("")) , m_strGlobalptr_Size(_T("")) { } DlgDirectory::~DlgDirectory() { } void DlgDirectory::DoDataExchange(CDataExchange* pDX) { CDialogEx::DoDataExchange(pDX); DDX_Text(pDX, IDC_EDIT_IMPORT_SIZE, m_strImport_Size); DDX_Text(pDX, IDC_EDIT_IMPORT_RVA, m_strImport_RVA); DDX_Text(pDX, IDC_EDIT_LOADCONFIG_RVA, m_strLoadConfig_RVA); DDX_Text(pDX, IDC_EDIT_LOADCONFIG_SIZE, m_strLoadConfig_Size); DDX_Text(pDX, IDC_EDIT_RELOCATION_RVA, m_strRelocation_RVA); DDX_Text(pDX, IDC_EDIT_RELOCATION_SIZE, m_strRelocation_Size); DDX_Text(pDX, IDC_EDIT_RESERVED_RVA, m_strReserved_RVA); DDX_Text(pDX, IDC_EDIT_RESERVED_SIZE, m_strReserved_Size); DDX_Text(pDX, IDC_EDIT_RESOURCE_RVA, m_strResource_RVA); DDX_Text(pDX, IDC_EDIT_RESOURCE_SIZE, m_strResource_Size); DDX_Text(pDX, IDC_EDIT_SECURITY_RVA, m_strSecurity_RVA); DDX_Text(pDX, IDC_EDIT_SECURITY_SIZE, m_strSecurity_Size); DDX_Text(pDX, IDC_EDIT_TLS_RVA, m_strTls_RVA); DDX_Text(pDX, IDC_EDIT_TLS_SIZE, m_strTls_Size); DDX_Text(pDX, IDC_EDIT_IAT_RVA, m_strIAT_RVA); DDX_Text(pDX, IDC_EDIT_IAT_SIZE, m_strIAT_Size); DDX_Text(pDX, IDC_EDIT_BOUNDIMPORT_RVA, m_strBoundImport_RVA); DDX_Text(pDX, IDC_EDIT_BOUNDIMPORT_SIZE, m_strBoundImport_Size); DDX_Text(pDX, IDC_EDIT_COM_RVA, m_strCom_RVA); DDX_Text(pDX, IDC_EDIT_COM_SIZE, m_strCom_Size); DDX_Text(pDX, IDC_EDIT_COPYIGHT_RVA, m_strCopyight_RVA); DDX_Text(pDX, IDC_EDIT_COPYIGHT_SIZE, m_strCopyight_Size); DDX_Text(pDX, IDC_EDIT_DEBUG_RVA, m_strDebug_RVA); DDX_Text(pDX, IDC_EDIT_DEBUG_SIZE, m_strDebug_Size); DDX_Text(pDX, IDC_EDIT_DELATIMPORT_RVA, m_strDelayImport_RVA); DDX_Text(pDX, IDC_EDIT_DELAYIMPORT_SIZE, m_strDelayImport_Size); DDX_Text(pDX, IDC_EDIT_DELAYIMPORT_RVA, m_strDelayImport_RVA); DDX_Text(pDX, IDC_EDIT_EXCEPTION_RVA, m_strException_RVA); DDX_Text(pDX, IDC_EDIT_EXCEPTION_SIZE, m_strException_Size); DDX_Text(pDX, IDC_EDIT_EXPORT_RVA, m_strExport_RVA); DDX_Text(pDX, IDC_EDIT_EXPORT_SIZE, m_strExport_Size); DDX_Text(pDX, IDC_EDIT_GLOBALPTR_RVA, m_strGlobalptr_RVA); DDX_Text(pDX, IDC_EDIT_GLOBALPTR_SIZE, m_strGlobalptr_Size); } BEGIN_MESSAGE_MAP(DlgDirectory, CDialogEx) ON_BN_CLICKED(IDC_BUTTON1, &DlgDirectory::OnBnClickedButton1) ON_BN_CLICKED(IDC_BUTTON2, &DlgDirectory::OnBnClickedButton2) ON_BN_CLICKED(IDC_BUTTON_EXPORT, &DlgDirectory::OnBnClickedButtonExport) ON_BN_CLICKED(IDC_BUTTON_IMPORT, &DlgDirectory::OnBnClickedButtonImport) ON_BN_CLICKED(IDC_BUTTON_RESOURCE, &DlgDirectory::OnBnClickedButtonResource) END_MESSAGE_MAP() // DlgDirectory 消息处理程序 BOOL DlgDirectory::OnInitDialog() { CDialogEx::OnInitDialog(); // TODO: 在此添加额外的初始化 PIMAGE_DATA_DIRECTORY pDataDirectory = g_PEstru.GetDataDirctory(); if (g_PEstru.IsReadonly()) { GetDlgItem(IDC_BUTTON2)->EnableWindow(false); } m_strExport_RVA.Format( "%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); m_strExport_Size.Format( "%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size); m_strImport_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress); m_strImport_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size); m_strResource_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress); m_strResource_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size); m_strException_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].VirtualAddress); m_strException_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].Size); m_strSecurity_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].VirtualAddress); m_strSecurity_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY].Size); m_strRelocation_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress); m_strRelocation_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size); m_strDebug_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress); m_strDebug_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].Size); m_strCopyight_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_ARCHITECTURE].VirtualAddress); m_strCopyight_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_ARCHITECTURE].Size); m_strGlobalptr_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_GLOBALPTR].VirtualAddress); m_strGlobalptr_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_GLOBALPTR].Size); m_strTls_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress); m_strTls_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].Size); m_strLoadConfig_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].VirtualAddress); m_strLoadConfig_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].Size); m_strBoundImport_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress); m_strBoundImport_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size); m_strIAT_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress); m_strIAT_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size); m_strDelayImport_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT].VirtualAddress); m_strDelayImport_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT].Size); m_strCom_RVA.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress); m_strCom_Size.Format("%.8X", pDataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].Size); //保留的一个 m_strReserved_RVA.Format("%.8X", 0); m_strReserved_Size.Format("%.8X",0); UpdateData(FALSE); return TRUE; // return TRUE unless you set the focus to a control // 异常: OCX 属性页应返回 FALSE } void DlgDirectory::OnBnClickedButton1() { // TODO: 在此添加控件通知处理程序代码 CDialogEx::OnOK(); } void DlgDirectory::OnBnClickedButton2() { // TODO: 在此添加控件通知处理程序代码 PIMAGE_DATA_DIRECTORY pDataDirectory = g_PEstru.GetDataDirctory(); DWORD RVA, Size; UpdateData(TRUE); pDataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress = strtol(m_strExport_RVA, NULL, 16); pDataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size = strtol(m_strExport_Size, NULL, 16); pDataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress = strtol(m_strImport_RVA, NULL, 16); pDataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size = strtol(m_strImpo