[原创]汇编编写Windows PE文件小工具
功能介绍
1). 支持多种PE文件加载方式，设置EXE/DLL文件关联
2). 添加区段、修改程序入口点，Dump文件、RVA->FOA转换
3). 查看导入表中的函数、查看字符串帮助快速预判程序功能
4). 日志导出功能使得查看的结果被保存，也方便进行进一步查看
程序界面
1.PE文件被加载界面:
2.添加区段
3.字符串查找
部分代码：
;**********************************************************************************************
;获取字符串，显示到ListView
;**********************************************************************************************
_getStringView proc _lpPeHeader,_hListBox
LOCAL @SectionNum
local @lpDataAddr,@dwDataSize,@dwMaxDataAddr
pushad
push SectionNum
pop @SectionNum
mov edi,_lpPeHeader
assume edi:ptr IMAGE_NT_HEADERS
add edi,sizeof IMAGE_NT_HEADERS
assume edi:ptr IMAGE_SECTION_HEADER
_loop1:
push edi
invoke lstrcmp,edi,addr lpDataSecName1
.if !eax
push [edi].PointerToRawData
pop @lpDataAddr
push [edi].SizeOfRawData
pop @dwDataSize
mov eax,@lpDataAddr
add eax,@dwDataSize
mov @dwMaxDataAddr,eax
.endif
pop edi
add edi,SectionHeaderSize
dec @SectionNum
jne _loop1
mov eax,dwVirtueSize
add @dwMaxDataAddr,eax
push dword ptr @lpDataAddr
pop edi
add edi,eax
mov ecx,@dwDataSize
_loop2:
invoke RtlZeroMemory,addr szDataBuffer,sizeof szDataBuffer
cld
mov ecx,@dwDataSize
repe scasb
dec edi
cmp edi,@dwMaxDataAddr
jg _end
mov esi,edi
invoke lstrlen,esi
mov ecx,eax
add edi,ecx
push edi
lea edi,szDataBuffer
cld
rep movsb
invoke SendMessage,_hListBox,LB_ADDSTRING,0,addr szDataBuffer
pop edi
inc edi
cmp edi,@dwMaxDataAddr
jb _loop2
_end:
push SectionNum
pop @SectionNum
mov edi,_lpPeHeader
assume edi:ptr IMAGE_NT_HEADERS
add edi,sizeof IMAGE_NT_HEADERS
assume edi:ptr IMAGE_SECTION_HEADER
_loop3:
push edi
invoke lstrcmp,edi,addr lpDataSecName2
.if !eax
push [edi].PointerToRawData
pop @lpDataAddr
push [edi].SizeOfRawData
pop @dwDataSize
mov eax,@lpDataAddr
add eax,@dwDataSize
mov @dwMaxDataAddr,eax
.endif
pop edi
add edi,SectionHeaderSize
dec @SectionNum
jne _loop3
mov eax,dwVirtueSize
add @dwMaxDataAddr,eax
push dword ptr @lpDataAddr
pop edi
add edi,eax
mov ecx,@dwDataSize
_loop4:
invoke RtlZeroMemory,addr szDataBuffer,sizeof szDataBuffer
cld
mov ecx,@dwDataSize
repe scasb
dec edi
cmp edi,@dwMaxDataAddr
jg _end1
mov esi,edi
invoke lstrlen,esi
mov ecx,eax
add edi,ecx
push edi
lea edi,szDataBuffer
cld
rep movsb
invoke SendMessage,_hListBox,LB_ADDSTRING,0,addr szDataBuffer
pop edi
inc edi
cmp edi,@dwMaxDataAddr
jb _loop4
_end1:
popad
ret
_getStringView endp
;**********************************************************************************************
;将区段信息在listBox中显示出来
;**********************************************************************************************
_getSectionView proc _hWnd
LOCAL @szSectionName[10]:byte
LOCAL @szBuffer[100]:byte
LOCAL @temp
pushad
push SectionNum
pop @temp
mov edi,lpPeHeader
assume edi:ptr IMAGE_NT_HEADERS
movzx ecx,[edi].FileHeader.NumberOfSections
add edi,sizeof IMAGE_NT_HEADERS
assume edi:ptr IMAGE_SECTION_HEADER
invoke SendMessage,hListBox,LB_ADDSTRING,0,addr szMsgSection
_loop:
invoke RtlZeroMemory,addr @szBuffer,sizeof @szBuffer
invoke RtlZeroMemory,addr @szSectionName,sizeof @szSectionName
mov esi,edi
push edi
lea edi,@szSectionName
mov ecx,8
cld
rep movsb
pop edi
invoke wsprintf,addr @szBuffer,addr szFmtSection,\
addr @szSectionName,[edi].VirtualAddress,\
[edi].Misc.VirtualSize,[edi].PointerToRawData,\
[edi].SizeOfRawData,[edi].Characteristics
invoke SendMessage,hListBox,LB_ADDSTRING,0,addr @szBuffer
add edi,SectionHeaderSize
dec @temp
jne _loop
popad
ret
_getSectionView endp
;**********************************************************************************************
;获取第一个节区和最后一个节区偏移地址，分别返回到baseCode, lpLastSection
;**********************************************************************************************
_getSectionVaddr proc
LOCAL @temp
nop
push esi
mov esi,lpPeHeader
assume esi:ptr IMAGE_NT_HEADERS
mov cx,[esi].FileHeader.NumberOfSections
movzx ecx,cx
add esi,sizeof IMAGE_NT_HEADERS
assume esi:ptr IMAGE_SECTION_HEADER
push [esi].VirtualAddress
pop baseCode
mov eax,sizeof IMAGE_SECTION_HEADER
dec ecx
mul ecx
add esi,eax
mov eax,[esi].VirtualAddress
add eax,[esi].Misc.VirtualSize
mov lpLastSection,eax
assume esi:nothing
pop esi
ret
_getSectionVaddr endp
;**********************************************************************************************
;添加新的区段
;**********************************************************************************************
_addNewSection proc _lpFileName,_lpSectionName
LOCAL @hfile,@filesize,@hfileMap
LOCAL _dwFileAlign,_dwSectionAlign
LOCAL @dwSec,@dwFile
pushad
invoke CreateFile,_lpFileName,GENERIC_WRITE+GENERIC_READ,FILE_SHARE_WRITE+FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,NULL
mov @hfile,eax
invoke GetFileSize,@hfile,NULL
mov @filesize,eax
add eax,APPEND_SIZE
invoke CreateFileMapping,@hfile,NULL,PAGE_READWRITE,0,eax,0
mov @hfileMap,eax
invoke MapViewOfFile,eax,FILE_MAP_WRITE+FILE_MAP_COPY,0,0,0
mov esi,eax
assume esi:ptr IMAGE_DOS_HEADER
add esi,[esi].e_lfanew
assume esi:ptr IMAGE_NT_HEADERS
xor ecx,ecx
mov cx,word ptr[esi].FileHeader.NumberOfSections ;区段数目
movzx ecx,cx
push esi
inc word ptr[esi].FileHeader.NumberOfSections
push [esi].OptionalHeader.FileAlignment ;文件偏移大小
pop _dwFileAlign
push [esi].OptionalHeader.SectionAlignment ;内存偏移大小
pop _dwSectionAlign
add esi,sizeof IMAGE_NT_HEADERS
assume esi:ptr IMAGE_SECTION_HEADER
mov eax,sizeof IMAGE_SECTION_HEADER
dec ecx
mul ecx
add esi,eax
assume esi:ptr IMAGE_SECTION_HEADER
invoke _Align,_dwSectionAlign,[esi].Misc.VirtualSize ;虚拟内存大小
add eax,[esi].VirtualAddress ;虚拟内存偏移
mov @dwSec,eax
mov edx,[esi].PointerToRawData ;物理内存偏移
add edx,[esi].SizeOfRawData ;物理内存大小
mov @dwFile,edx
add esi,sizeof IMAGE_SECTION_HEADER
assume esi:ptr IMAGE_SECTION_HEADER
push 0E0000020h ;可读可写可执行属性
pop [esi].Characteristics
push @dwSec
pop [esi].VirtualAddress
mov [esi].PointerToRawData,edx
invoke _Align,_dwFileAlign,dwSectionSize ;按文件偏移大小对齐文件
push eax
pop [esi].SizeOfRawData
mov [esi].Misc.VirtualSize,eax
lea edi,[esi].Name1 ;区段名
mov esi,_lpSectionName
invoke lstrlen,esi
mov ecx,eax
cld
rep movsb
pop esi
assume esi:ptr IMAGE_NT_HEADERS
mov eax,_dwSectionAlign
add eax,@dwSec
mov [esi].OptionalHeader.SizeOfImage,eax ;修改镜像大小
assume esi:nothing
invoke CloseHandle,@hfileMap
invoke CloseHandle,@hfile
popad
ret
_addNewSection endp
PE_Tools.zip
