delphi 给EXE文件增加区段

学习 PE 可执行文件格式，用 delphi 实现给 EXE 文件增加区段

源码下载(StudyPE.zip)

unit uStudyPE;

interface
uses
  Classes, SysUtils, Windows, uPERec;

type

  TImage_Section_headerList = class;

  TStudyPE = class
  private
    FFileStream: TFileStream;
    FNewStream: TMemoryStream;
    FImage_Dos_Header: PImage_DOS_Header;
    FImage_NT_Headers: PImage_NT_Headers;
    FImage_Section_HeaderList: TImage_Section_headerList;
  public
    constructor Create;
    destructor Destroy; override;
  public
    procedure LoadPE(AFileName: string);
    property Image_Dos_Header: PImage_DOS_Header read FImage_Dos_Header;
    property Image_NT_Headers: PImage_NT_Headers read FImage_NT_Headers;
    property Image_Section_HeaderList: TImage_Section_headerList read FImage_Section_HeaderList;
  end;

  TImage_Section_headerList = class(TList)
  public
    procedure FreeAllItems();
    destructor Destroy; override;
  end;

implementation
{ TStudyPE }
const
  Image_Dos_Header_len = SizeOf(TImage_dos_header);
  Image_NT_Headers_len = SizeOf(TImage_NT_Headers);
  Image_Section_Header_len = SizeOf(TImage_Section_Header);

constructor TStudyPE.Create;
begin
  inherited Create;
  New(FImage_Dos_Header);
  New(FImage_NT_Headers);
  FImage_Section_HeaderList := TImage_Section_headerList.Create;
  FNewStream := TMemoryStream.Create;
end;

destructor TStudyPE.Destroy;
begin
  Dispose(FImage_Dos_Header);
  Dispose(FImage_NT_Headers);
  FImage_Section_HeaderList.Free;
  FNewStream.Free;
  inherited;
end;

procedure TStudyPE.LoadPE(AFileName: string);
var

  e_lfanew: DWORD;
  pSecHeader: PImage_Section_header;
  nNumberOfSections: word;
  i: integer;
  nDosStubLen: integer;
  nSizeOfImage: DWORD;
  LImage_Section_header: TImage_Section_Header;
  Rva: DWORD;
  vaSize: DWORD;

  SizeOfHeaders: DWORD; // 一般是 $400
  NewSectionSize: DWORD; // 新增区段大小

begin

  if Assigned(FFileStream) then
  begin
    FFileStream.Free;
  end;

  NewSectionSize := $200;

  FFileStream := TFileStream.Create(AFileName, fmOpenRead);
  FFileStream.Read(FImage_Dos_Header^, Image_Dos_Header_len); // 读 DOS 头,64字节

  FNewStream.Size := FFileStream.Size + NewSectionSize; // 新文件大小
  FNewStream.Write(FImage_Dos_Header^, Image_Dos_Header_len); // 将 DOS 头写入新文件

  e_lfanew := FImage_Dos_Header.e_lfanew; // 获取 Image_NT_Headers 的位置
  nDosStubLen := e_lfanew - Image_Dos_Header_len; // DOS 汇编代码区域长度

  // 将 DOS 汇编代码写入新文件,写完后 FFileStream.Position 正好在 Image_NT_Header 的位置上
  FFileStream.Read((Pbyte(FNewStream.Memory) + Image_Dos_Header_len)^, nDosStubLen);
  FNewStream.Position := Image_Dos_Header_len + nDosStubLen;

  FFileStream.Read(FImage_NT_Headers^, Image_NT_Headers_len); // 获取 Image_NT_Headers
  SizeOfHeaders := FImage_NT_Headers.Image_Optional_Header32.SizeOfHeaders;

  nNumberOfSections := FImage_NT_Headers.Image_File_Header.NumberOfSections; // 区段数量
  FImage_NT_Headers.Image_File_Header.NumberOfSections := nNumberOfSections + 1; // 增加区段数量

  nSizeOfImage := FImage_NT_Headers.Image_Optional_Header32.SizeOfImage;
  FImage_NT_Headers.Image_Optional_Header32.SizeOfImage := nSizeOfImage + NewSectionSize; // 修改 EXE 所占内存大小
  FNewStream.Write(FImage_NT_Headers^, Image_NT_Headers_len); // 将 Image_NT_Headers 写入新文件

  FImage_Section_HeaderList.FreeAllItems;

  for i := 0 to nNumberOfSections - 1 do
  begin
    New(pSecHeader);
    FImage_Section_HeaderList.Add(pSecHeader);
    FFileStream.Read(pSecHeader^, Image_Section_Header_len);
    FNewStream.Write(pSecHeader^, Image_Section_Header_len); // 将各个 Image_Section_Header 写入新文件
  end;

  LImage_Section_header := pSecHeader^;

  // 给新区段命名
  LImage_Section_header.Name[0] := ord('.');
  LImage_Section_header.Name[1] := ord('N');
  LImage_Section_header.Name[2] := ord('E');
  LImage_Section_header.Name[3] := ord('W');
  LImage_Section_header.Name[4] := ord('T');
  LImage_Section_header.Name[5] := ord('E');
  LImage_Section_header.Name[6] := ord('S');
  LImage_Section_header.Name[7] := ord('T');

  // 用最后一个区段作参考计算新增区段的 VirtualAddress,PointerToRawData 的值
  // VirtualAddress 是在EXE中虚拟地址
  // PointerToRawData 新区段在文件中的位置
  Rva := pSecHeader.VirtualAddress;
  vaSize := ((pSecHeader.Misc.VirtualSize + $FFF) div $1000) * $1000;
  LImage_Section_header.VirtualAddress := Rva + vaSize; // 新区段的虚拟地址

  Rva := pSecHeader.PointerToRawData;
  vaSize := ((pSecHeader.Misc.VirtualSize + $1FF) div $200) * $200;
  LImage_Section_header.PointerToRawData := Rva + vaSize; // 新区段的文件中的位置

  LImage_Section_header.Misc.VirtualSize := NewSectionSize;
  LImage_Section_header.SizeOfRawData := NewSectionSize;
  LImage_Section_header.Characteristics := $50000040; // 区段的属性(读,写,执行)

  // 要计算位置是否够放新 Section, 未完成,本例所改的 exe 是可以的。

  if ((SizeOfHeaders - FFileStream.Position) < Image_Section_Header_len) then
  begin
    raise Exception.Create('区段位置不够，本Demo无法操作!');
    // 为了简单，所以这样操作了。实际上是可以的，只是每个区段都得重新计算虚拟地址与在文件中的地址
  end;

  FNewStream.Write(LImage_Section_header, Image_Section_Header_len); // 将新增 Image_Section_Header 写入新文件

  // 将源文件剩下的数据写入新文件
  FFileStream.Seek(SizeOfHeaders, soBeginning);
  FFileStream.Read((Pbyte(FNewStream.Memory) + SizeOfHeaders)^, FFileStream.Size - SizeOfHeaders);
  FNewStream.SaveToFile('new.exe');

end;

{ TImage_Section_headerList }

destructor TImage_Section_headerList.Destroy;
begin
  FreeAllItems;
  inherited;
end;

procedure TImage_Section_headerList.FreeAllItems;
var
  p: PImage_Section_header;
begin
  for p in self do
    Dispose(p);
  Clear;
end;

end.

uStudyPE.pas