PE区段添加编写中的一点心得~

为PE区段的加区段，修改PE头的映像大小= =

代码如下：

BOOL LPESection::AddSection(char *pSectionName, DWORD &dwSectionSize,DWORD dwSectionStact)
{
    LPVOID lPointer=NULL;
 PBYTE  pData=NULL;
    DWORD  newSectionAddr=0;
 
 if (!IsPEFile())
 {
  return FALSE;
 }

 PIMAGE_NT_HEADERS pNTHdr=GetNtHeader();
    //是否有足够空间容纳节头
 if ((pNTHdr->FileHeader.NumberOfSections+1)*sizeof(IMAGE_SECTION_HEADER)>pNTHdr->OptionalHeader.SizeOfHeaders)
    {
  return FALSE;
    }
    //对齐数据
 DWORD uCodeDelta=ZALIGN(dwSectionSize,pNTHdr->OptionalHeader.SectionAlignment);
 DWORD uFileDelta=ZALIGN(dwSectionSize,pNTHdr->OptionalHeader.FileAlignment);

 PIMAGE_SECTION_HEADER pNewSec=(PIMAGE_SECTION_HEADER)(pNTHdr+1)+pNTHdr->FileHeader.NumberOfSections;
 PIMAGE_SECTION_HEADER pLaseSec=pNewSec-1;

 //----------为将要创建的节赋值----------
 strcpy((char*)pNewSec->Name,pSectionName);
 pNewSec->VirtualAddress=pLaseSec->VirtualAddress+ZALIGN(pLaseSec->Misc.VirtualSize,pNTHdr->OptionalHeader.SectionAlignment);
 newSectionAddr=pNewSec->PointerToRawData=pLaseSec->PointerToRawData+pLaseSec->SizeOfRawData;
 pNewSec->Misc.VirtualSize=dwSectionSize;
 pNewSec->SizeOfRawData=uFileDelta;
 pNewSec->Characteristics=dwSectionStact;

 //-------PE头的一些设置-----------------
 pNTHdr->FileHeader.NumberOfSections++;
 pNTHdr->OptionalHeader.SizeOfCode+=uFileDelta;
 pNTHdr->OptionalHeader.SizeOfImage+=uCodeDelta;

 pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size=0;
    pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress=0;

 dwSectionSize=uFileDelta;

 //改变自身数据
 DWORD dwOldSize=pstMapFile->dwFileSize;
 pstMapFile->dwFileSize+=dwSectionSize;

 UnmapViewOfFile(pstMapFile->hMapping);
 CloseHandle(pstMapFile->hMapping);
 pstMapFile->hMapping=CreateFileMapping(pstMapFile->hFile,NULL,PAGE_READWRITE,0,pstMapFile->dwFileSize,NULL);
 pstMapFile->ImageBase=MapViewOfFile(pstMapFile->hMapping,FILE_MAP_ALL_ACCESS,0,0,pstMapFile->dwFileSize);
 return TRUE;

}

pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size=0;
    pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress=0;

上面这两行是平常在其他加区段的代码中不常见的，比如zapline的添加区段代码。如果没有上面这两句，那么对一些有bound iat的程序加壳后不能运行。原因

是IMAGE_BOUND_IMPORT_DESCTIPTOR结构中的OffsetModuleName变量存放的是与第一个IBID结构之间的偏移(不是RVA)。当你加了个新区段后，这个偏

移改变了，所以加壳就失败了~~