增加 SizeOfImage, VirtualSize, SizeOfRawData, 注意文件對(duì)齊和內(nèi)存對(duì)齊即可。

擴(kuò)大節(jié)函數(shù)

// 擴(kuò)大最后一個(gè)節(jié) // 返回新文件的大小，失敗返回0 DWORD ExpandLastSection(LPVOID pFileBuffer, LPVOID *pNewFileBuffer, DWORD dwOldSize, DWORD dwExpandSize) {PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew);PIMAGE_FILE_HEADER pPEHeader = (PIMAGE_FILE_HEADER)((DWORD)pDosHeader + pDosHeader->e_lfanew + 4);PIMAGE_OPTIONAL_HEADER32 pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + sizeof(IMAGE_FILE_HEADER));PIMAGE_SECTION_HEADER pSectionHeader = \(PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader + pPEHeader->SizeOfOptionalHeader);DWORD dwVirtualSizeExpand = Align(dwExpandSize, pOptionHeader->SectionAlignment);DWORD dwRawDataExpand = Align(dwExpandSize, pOptionHeader->FileAlignment);*pNewFileBuffer = malloc(dwOldSize + dwRawDataExpand);memcpy(*pNewFileBuffer, pFileBuffer, dwOldSize);memset((LPVOID)((DWORD)(*pNewFileBuffer) + dwOldSize), 0, dwRawDataExpand);pDosHeader = (PIMAGE_DOS_HEADER)*pNewFileBuffer;pNTHeader = (PIMAGE_NT_HEADERS)(pDosHeader->e_lfanew + (DWORD)*pNewFileBuffer);pPEHeader = (PIMAGE_FILE_HEADER)((DWORD)pNTHeader + 4);pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pNTHeader + 0x18);pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader + pPEHeader->SizeOfOptionalHeader);// 修改新內(nèi)存的屬性pSectionHeader[pPEHeader->NumberOfSections - 1].Misc.VirtualSize += dwVirtualSizeExpand;pSectionHeader[pPEHeader->NumberOfSections - 1].SizeOfRawData += dwRawDataExpand;pOptionHeader->SizeOfImage += dwVirtualSizeExpand;return dwOldSize + dwRawDataExpand; }

運(yùn)行結(jié)果+節(jié)表屬性對(duì)比

大小增加符合對(duì)齊要求（文件對(duì)齊和內(nèi)存對(duì)齊都是1000h）

VirtualSize 和 SizeOfRawData 增加了 2000h，符合預(yù)期。

總結(jié)

以上是生活随笔為你收集整理的PE扩大最后一个节的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。