Skip to content

Commit 29750da

Browse files
kyle-gokyle-go
authored
Add files via upload
1 parent fe36449 commit 29750da

File tree

2 files changed

+348
-0
lines changed

2 files changed

+348
-0
lines changed

‎append_signed_pe.cpp‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
// test.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
2+
//
3+
4+
#include <windows.h>
5+
#include <stdio.h>
6+
#include <string>
7+
#include "imagehlp.h"
8+
#pragma comment(lib, "Imagehlp.lib")
9+
10+
11+
// 追加的内容
12+
BOOL AppendSignExeData(const std::wstring& f, const std::string& data) {
13+
HANDLE fileHandle = CreateFileW(f.c_str(), GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
14+
if (fileHandle == INVALID_HANDLE_VALUE) {
15+
return 0;
16+
}
17+
18+
HANDLE mapHandle = CreateFileMapping(fileHandle, NULL, PAGE_READWRITE, 0, 0, NULL);
19+
if (mapHandle == NULL) {
20+
CloseHandle(fileHandle);
21+
return 0;
22+
}
23+
24+
LPBYTE lpBaseAddress = (LPBYTE)MapViewOfFile(mapHandle, FILE_MAP_READ | FILE_MAP_WRITE, 0, 0, 0);
25+
if (lpBaseAddress == NULL) {
26+
CloseHandle(mapHandle);
27+
CloseHandle(fileHandle);
28+
return 0;
29+
}
30+
31+
PIMAGE_DOS_HEADER dosHead = (PIMAGE_DOS_HEADER)lpBaseAddress;
32+
PIMAGE_NT_HEADERS32 ntHead = (PIMAGE_NT_HEADERS32)(lpBaseAddress + dosHead->e_lfanew);
33+
PIMAGE_NT_HEADERS64 ntHead64 = (PIMAGE_NT_HEADERS64)(lpBaseAddress + dosHead->e_lfanew);
34+
if (dosHead->e_magic != IMAGE_DOS_SIGNATURE || ntHead->Signature != IMAGE_NT_SIGNATURE) {
35+
UnmapViewOfFile(lpBaseAddress);
36+
CloseHandle(mapHandle);
37+
CloseHandle(fileHandle);
38+
return 0;
39+
}
40+
41+
// 判断是否是x64
42+
BOOL isX64 = (ntHead->OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR32_MAGIC);
43+
PIMAGE_DATA_DIRECTORY idd = NULL;
44+
if (isX64) {
45+
idd = &ntHead64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY];
46+
}
47+
else {
48+
idd = &ntHead->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY];
49+
}
50+
if (idd->Size == 0 || idd->VirtualAddress == 0) {
51+
UnmapViewOfFile(lpBaseAddress);
52+
CloseHandle(mapHandle);
53+
CloseHandle(fileHandle);
54+
return 0;
55+
}
56+
57+
DWORD writeSize = (DWORD)(data.size() + 7) / 8 * 8;
58+
59+
// 修改Security.Size
60+
idd->Size += writeSize + 8;
61+
62+
UnmapViewOfFile(lpBaseAddress);
63+
CloseHandle(mapHandle);
64+
65+
SetFilePointer(fileHandle, 0, 0, FILE_END);
66+
DWORD size = 0;
67+
WriteFile(fileHandle, (LPCVOID)data.c_str(), (DWORD)data.length(), &size, NULL);
68+
if (size != data.length()) {
69+
CloseHandle(fileHandle);
70+
return 0;
71+
}
72+
73+
// 补上多余的几个
74+
if (writeSize > data.size()) {
75+
for (DWORD i = 0; i < writeSize - data.size(); i++) {
76+
size = 0;
77+
WriteFile(fileHandle, "\0", 1, &size, NULL);
78+
if (size != 1) {
79+
CloseHandle(fileHandle);
80+
return 0;
81+
}
82+
}
83+
}
84+
85+
size = 0;
86+
UINT64 len = (UINT64)data.size();
87+
WriteFile(fileHandle, (LPCVOID)&len, 8, &size, NULL);
88+
if (size != 8) {
89+
CloseHandle(fileHandle);
90+
return 0;
91+
}
92+
93+
// 修改校验和（因为有些杀软会将校验和不对的程序报毒）
94+
mapHandle = CreateFileMapping(fileHandle, NULL, PAGE_READWRITE, 0, 0, NULL);
95+
if (mapHandle == NULL) {
96+
CloseHandle(fileHandle);
97+
return 0;
98+
}
99+
lpBaseAddress = (LPBYTE)MapViewOfFile(mapHandle, FILE_MAP_READ | FILE_MAP_WRITE, 0, 0, 0);
100+
if (lpBaseAddress == NULL) {
101+
CloseHandle(mapHandle);
102+
CloseHandle(fileHandle);
103+
return 0;
104+
}
105+
106+
DWORD file_len = GetFileSize(fileHandle, NULL);
107+
if (file_len == INVALID_FILE_SIZE) {
108+
UnmapViewOfFile(lpBaseAddress);
109+
CloseHandle(mapHandle);
110+
CloseHandle(fileHandle);
111+
return 0;
112+
}
113+
114+
// 这个PIMAGE_NT_HEADERS设计的非常巧妙，无论是32还是64，CheckSum的偏移是一样的，所以这个代码不需要改，都兼容
115+
DWORD oldCheckSum, newCheckSum;
116+
PIMAGE_NT_HEADERS peHeader = CheckSumMappedFile((PVOID)lpBaseAddress, file_len, &oldCheckSum, &newCheckSum);
117+
peHeader->OptionalHeader.CheckSum = newCheckSum;
118+
119+
UnmapViewOfFile(lpBaseAddress);
120+
CloseHandle(mapHandle);
121+
CloseHandle(fileHandle);
122+
return TRUE;
123+
}
124+
125+
// 成功返回追加内容，失败返回空字符串
126+
std::string ReadSignExeData(const std::wstring& f) {
127+
HANDLE fileHandle = CreateFileW(f.c_str(), GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
128+
if (fileHandle == INVALID_HANDLE_VALUE) {
129+
return "";
130+
}
131+
DWORD ret = SetFilePointer(fileHandle, -8, 0, FILE_END);
132+
if (ret == INVALID_SET_FILE_POINTER) {
133+
CloseHandle(fileHandle);
134+
return "";
135+
}
136+
137+
UINT64 len = 0;
138+
DWORD size = 0;
139+
ReadFile(fileHandle, &len, 8, &size, NULL);
140+
if (size != 8) {
141+
CloseHandle(fileHandle);
142+
return "";
143+
}
144+
145+
// 若是大于200MB, 当作出错处理
146+
if (len > 1024 * 1024 * 200) {
147+
CloseHandle(fileHandle);
148+
return "";
149+
}
150+
151+
LONG readSize = (LONG)(len + 7) / 8 * 8;
152+
ret = SetFilePointer(fileHandle, -(readSize + 8), 0, FILE_END);
153+
if (ret == INVALID_SET_FILE_POINTER) {
154+
CloseHandle(fileHandle);
155+
return "";
156+
}
157+
158+
size = 0;
159+
std::string result;
160+
result.resize((size_t)len);
161+
ReadFile(fileHandle, (LPVOID)result.c_str(), (DWORD)len, &size, NULL);
162+
CloseHandle(fileHandle);
163+
164+
if (size != len) {
165+
return "";
166+
}
167+
return result;
168+
}
169+
170+
int main()
171+
{
172+
std::string data = "hello,world---";
173+
BOOL xxx = AppendSignExeData(L"D:\\pe.exe", data);
174+
if (xxx) {
175+
auto read_data = ReadSignExeData(L"D:\\pe.exe");
176+
if (read_data != data) {
177+
printf("ERROR!!!\r\n");
178+
}
179+
else {
180+
printf("OK!!!\r\n");
181+
}
182+
}
183+
else {
184+
printf("ERROR!!!\r\n");
185+
}
186+
187+
return 0;
188+
}

‎append_signed_pe.vcxproj‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<VCProjectVersion>15.0</VCProjectVersion>
23+
<ProjectGuid>{E9D2FF6C-8321-4005-80FC-A280DBD505D5}</ProjectGuid>
24+
<Keyword>Win32Proj</Keyword>
25+
<RootNamespace>append_signed_pe</RootNamespace>
26+
<WindowsTargetPlatformVersion>10.0.19041.0</WindowsTargetPlatformVersion>
27+
</PropertyGroup>
28+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
29+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
30+
<ConfigurationType>Application</ConfigurationType>
31+
<UseDebugLibraries>true</UseDebugLibraries>
32+
<PlatformToolset>v141</PlatformToolset>
33+
<CharacterSet>Unicode</CharacterSet>
34+
</PropertyGroup>
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
36+
<ConfigurationType>Application</ConfigurationType>
37+
<UseDebugLibraries>false</UseDebugLibraries>
38+
<PlatformToolset>v140_xp</PlatformToolset>
39+
<WholeProgramOptimization>true</WholeProgramOptimization>
40+
<CharacterSet>Unicode</CharacterSet>
41+
</PropertyGroup>
42+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
43+
<ConfigurationType>Application</ConfigurationType>
44+
<UseDebugLibraries>true</UseDebugLibraries>
45+
<PlatformToolset>v141</PlatformToolset>
46+
<CharacterSet>Unicode</CharacterSet>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
49+
<ConfigurationType>Application</ConfigurationType>
50+
<UseDebugLibraries>false</UseDebugLibraries>
51+
<PlatformToolset>v141</PlatformToolset>
52+
<WholeProgramOptimization>true</WholeProgramOptimization>
53+
<CharacterSet>Unicode</CharacterSet>
54+
</PropertyGroup>
55+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
56+
<ImportGroup Label="ExtensionSettings">
57+
</ImportGroup>
58+
<ImportGroup Label="Shared">
59+
</ImportGroup>
60+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
61+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
62+
</ImportGroup>
63+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
64+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
65+
</ImportGroup>
66+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
67+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
68+
</ImportGroup>
69+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
70+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
71+
</ImportGroup>
72+
<PropertyGroup Label="UserMacros" />
73+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
74+
<LinkIncremental>true</LinkIncremental>
75+
</PropertyGroup>
76+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
77+
<LinkIncremental>true</LinkIncremental>
78+
</PropertyGroup>
79+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
80+
<LinkIncremental>false</LinkIncremental>
81+
</PropertyGroup>
82+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
83+
<LinkIncremental>false</LinkIncremental>
84+
</PropertyGroup>
85+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
86+
<ClCompile>
87+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
88+
<WarningLevel>Level3</WarningLevel>
89+
<Optimization>Disabled</Optimization>
90+
<SDLCheck>true</SDLCheck>
91+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
92+
<ConformanceMode>true</ConformanceMode>
93+
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
94+
</ClCompile>
95+
<Link>
96+
<SubSystem>Console</SubSystem>
97+
<GenerateDebugInformation>true</GenerateDebugInformation>
98+
<AdditionalDependencies>ntdll.lib;%(AdditionalDependencies)</AdditionalDependencies>
99+
</Link>
100+
</ItemDefinitionGroup>
101+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
102+
<ClCompile>
103+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
104+
<WarningLevel>Level3</WarningLevel>
105+
<Optimization>Disabled</Optimization>
106+
<SDLCheck>true</SDLCheck>
107+
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
108+
<ConformanceMode>true</ConformanceMode>
109+
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
110+
</ClCompile>
111+
<Link>
112+
<SubSystem>Console</SubSystem>
113+
<GenerateDebugInformation>true</GenerateDebugInformation>
114+
</Link>
115+
</ItemDefinitionGroup>
116+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
117+
<ClCompile>
118+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
119+
<WarningLevel>Level3</WarningLevel>
120+
<Optimization>MaxSpeed</Optimization>
121+
<FunctionLevelLinking>true</FunctionLevelLinking>
122+
<IntrinsicFunctions>true</IntrinsicFunctions>
123+
<SDLCheck>true</SDLCheck>
124+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
125+
<ConformanceMode>true</ConformanceMode>
126+
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
127+
</ClCompile>
128+
<Link>
129+
<SubSystem>Console</SubSystem>
130+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
131+
<OptimizeReferences>true</OptimizeReferences>
132+
<GenerateDebugInformation>true</GenerateDebugInformation>
133+
</Link>
134+
</ItemDefinitionGroup>
135+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
136+
<ClCompile>
137+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
138+
<WarningLevel>Level3</WarningLevel>
139+
<Optimization>MaxSpeed</Optimization>
140+
<FunctionLevelLinking>true</FunctionLevelLinking>
141+
<IntrinsicFunctions>true</IntrinsicFunctions>
142+
<SDLCheck>true</SDLCheck>
143+
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
144+
<ConformanceMode>true</ConformanceMode>
145+
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
146+
</ClCompile>
147+
<Link>
148+
<SubSystem>Console</SubSystem>
149+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
150+
<OptimizeReferences>true</OptimizeReferences>
151+
<GenerateDebugInformation>true</GenerateDebugInformation>
152+
</Link>
153+
</ItemDefinitionGroup>
154+
<ItemGroup>
155+
<ClCompile Include="append_signed_pe.cpp" />
156+
</ItemGroup>
157+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
158+
<ImportGroup Label="ExtensionTargets">
159+
</ImportGroup>
160+
</Project>

0 commit comments

Comments
 (0)