?? frmmain.frm
字號:
End If
hFile = Ret
If Not isPE(FilePath) Then
MsgBox "不是有效的PE文件", vbInformation + vbOKOnly, "提示"
GoTo ErrHandle
End If
SetFilePointer hFile, &H3C, 0, FILE_BEGIN
'''&H3C 為保存PE結(jié)構(gòu)地址的文件偏移地址
ReadFileLng hFile, ByVal VarPtr(dwPE_Header_OffSet), 4, lngBytesRead, 0 '讀取 e_lfanew字段
'PE signature (PE) PE結(jié)構(gòu)的地址
SetFilePointer hFile, dwPE_Header_OffSet, 0, FILE_BEGIN
ReadFileLng hFile, ByVal VarPtr(PE_Header), Len(PE_Header) + Len(SECTION_Header), lngBytesRead, 0
'**************************************************
'判斷是否有多余空間來新增區(qū)段
'**************************************************
SECTION_Num = PE_Header.FileHeader.NumberOfSections
SECTION_Mount = SECTION_Num * &H28 '&h28 = sizeof IMAGE_SECTION_HEADER
SECTION_Mount = SECTION_Mount + dwPE_Header_OffSet '+PE文件頭偏移
SECTION_Mount = SECTION_Mount + &H18 'sizeof IMAGE_FILE_HEADER + "PE"
SECTION_Mount = SECTION_Mount + PE_Header.FileHeader.SizeOfOptionalHeader 'sizeof IMAGE_OPTIONAL_HEADER
SECTION_Mount = SECTION_Mount + &H28
If SECTION_Mount > PE_Header.OptionalHeader.SizeOfHeaders Then
MsgBox "沒有足夠空間加入新節(jié)", vbInformation + vbOKOnly, "提示"
GoTo ErrHandle
End If
'保存原入口
Old_AddressOfEntryPoint = PE_Header.OptionalHeader.AddressOfEntryPoint
Old_ImageBase = PE_Header.OptionalHeader.ImageBase
'**************************************************
'計算新節(jié)的偏移地址：
'**************************************************
dwMySectionOffSet = PE_Header.FileHeader.NumberOfSections * &H28
'dwMySectionOffSet = dwMySectionOffSet + 4 ';4h = sizeof "PE\0\0"
dwMySectionOffSet = dwMySectionOffSet + dwPE_Header_OffSet
dwMySectionOffSet = dwMySectionOffSet + &H18
dwMySectionOffSet = dwMySectionOffSet + Len(OPTIONAL_Header) 'OPTIONAL_Header = IMAGE_OPTIONAL_HEADER
'新節(jié)偏移地址
' ;****************************************
' ;填充我們自己的節(jié)的信息：
' ;****************************************
strSectionName = (StrConv(strNewSectionName, vbFromUnicode))
Call CopyMemory(ByVal VarPtr(SECTION_Header.SectionName(0)), ByVal StrPtr(strSectionName), 8)
SECTION_Header.VirtualSize = lngNewSectionSize
SECTION_Header.VirtualAddress = PE_Header.OptionalHeader.SizeOfImage
SECTION_Header.SizeOfRawData = (SECTION_Header.VirtualSize \ PE_Header.OptionalHeader.FileAlignment + 1) * PE_Header.OptionalHeader.FileAlignment
'SizeOfRawData在EXE文件中是對齊到FileAlignMent的整數(shù)倍的值
NewOffset = dwMySectionOffSet - &H18
'這個偏移是定位到最后一節(jié)的“SizeOfRawData” &h18 = sizeof IMAGE_FILE_HEADER
SetFilePointer hFile, NewOffset, 0, FILE_BEGIN
ReadFileLng hFile, ByVal VarPtr(dwLastSection_SizeOfRawData), 4, lngBytesRead, 0
ReadFileLng hFile, ByVal VarPtr(dwLastSection_PointerToRawData), 4, lngBytesRead, 0
'每個節(jié)的 PointerToRawData 等于它的上一節(jié)的 SizeOfRawData + PointerToRawData：
SECTION_Header.PointerToRawData = dwLastSection_SizeOfRawData + dwLastSection_PointerToRawData
SECTION_Header.PointerToRelocations = 0
SECTION_Header.PointerToLinenumbers = 0
SECTION_Header.NumberOfRelocations = 0
SECTION_Header.NumberOfLinenumbers = 0
SECTION_Header.Characteristics = &HE0000020 ';可讀可寫可執(zhí)行
'''計算jmp的偏移量
' Select Case ComboFakeCode.Text
' Case "EXECryptor 1.x.x -> SoftComplete Developement":
' strFakeCode = strEXECryptor
' Case "ASPack 2.12 -> Alexey Solodovnikov":
' strFakeCode = strAsPack
' Case ".BJFNT 1.3 -> :MARQUiS:":
' strFakeCode = strBJFNT
' Case "EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE *":
' strFakeCode = strExeShield
' End Select
strFakeCode = Replace$(strFakeCode, " ", "")
''''這里開始加入反調(diào)試
If chkIsDebuggerPresent Then
strFakeCode = strFakeCode & strIsDebuggerPresent
End If
''''''''''''''''''''''
strFakeCode = strFakeCode & "E9"
lngjmpOffset = Len(strFakeCode) \ 2 ''''由于花指令而增加的偏移量
lngjmpOffset = lngjmpOffset + SECTION_Header.VirtualAddress ''''新增的Ep+增加的代碼偏移
lngjmpOffset = Old_AddressOfEntryPoint - lngjmpOffset - 4 ' 往回跳
'由于本加花都是跨區(qū)段回跳 地址占了 4位 如 E9 ****FFFF
strFakeCode = strFakeCode & ReverseBytes(Hex8(lngjmpOffset))
CodeBuf.nBuf = 0 '在模塊中定義
AddCode strFakeCode
' ;****************************************
' ;是否改寫所有區(qū)段名稱：
' ;****************************************
Section_Offset = dwPE_Header_OffSet + &H18 + Len(OPTIONAL_Header)
strSectionName = (StrConv(strNewSectionName, vbFromUnicode))
If chkModifySectionName And SECTION_Num >= 1 Then
For i = 1 To SECTION_Num
SetFilePointer hFile, Section_Offset + (i - 1) * &H28, 0, FILE_BEGIN '&H28 = sizeof(section)
WriteFileLng hFile, ByVal StrPtr(strSectionName), 8, lngBytesRead, 0
Next
End If
' ;**************************************************
' ;重新寫入IMAGE_SECTION_HEADER：（包含了新節(jié)的信息）
' ;**************************************************
SetFilePointer hFile, dwMySectionOffSet, 0, FILE_BEGIN
WriteFileLng hFile, ByVal VarPtr(SECTION_Header), Len(SECTION_Header), lngBytesRead, 0
' ;****************************************
' ;在文件的最后寫入我們的新節(jié)：
' ;預(yù)留效果:
' ; 1.加花的時候 可以把程序的區(qū)段名 改掉
' ; 2.添加 Anti-Debug 代碼
' ;****************************************
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
SetFilePointer hFile, 0, 0, FILE_END
WriteFileLng hFile, ByVal VarPtr(CodeBuf.Code.Buf(0)), SECTION_Header.SizeOfRawData, lngBytesRead, 0
' ;**************************************************
' ;改寫IMAGE_NT_HEADERS，使新節(jié)可以首先執(zhí)行：
' ;（需要改寫 SizeOfImage 和 AddressOfEntryPoint）
' ;**************************************************
PE_Header.FileHeader.NumberOfSections = PE_Header.FileHeader.NumberOfSections + 1
PE_Header.OptionalHeader.SizeOfImage = PE_Header.OptionalHeader.SizeOfImage + (SECTION_Header.VirtualSize \ PE_Header.OptionalHeader.FileAlignment + 1) * PE_Header.OptionalHeader.FileAlignment
'SizeOfImage是一個對齊到SectionAlignment的整數(shù)倍的值
PE_Header.OptionalHeader.AddressOfEntryPoint = SECTION_Header.VirtualAddress
'現(xiàn)在的 AddressOfEntryPoint 是指向新節(jié)的第一條指令
SetFilePointer hFile, dwPE_Header_OffSet, 0, FILE_BEGIN
WriteFileLng hFile, ByVal VarPtr(PE_Header), Len(PE_Header), lngBytesRead, 0
MsgBox "加花成功,請檢查！", vbInformation + vbOKOnly, "提示"
ErrHandle:
CloseHandle hFile
End Sub
Public Sub GotADrop(strFileName As String)
txtFilePath.Text = strFileName
End Sub
Private Sub ComboFakeCode_Click()
' ComboFakeCode.ListIndex 就是xml文件節(jié)點的 index
Dim i As Long
Debug.Print ComboFakeCode.ListIndex
strFakeCode = xmlReadWrite.GetChildValue("/junkCode/HexCode", ComboFakeCode.ListIndex)
End Sub
Private Sub ComboFakeCode_KeyPress(KeyAscii As Integer)
KeyAscii = 0
End Sub
Private Sub Form_Load()
Dim i As Long
If Dir(App.Path & "\config.xml") <> "" Then
If Not (xmlReadWrite.OpenXML(App.Path & "\config.xml")) Then
MsgBox "讀取配置文件錯誤", vbInformation, "提示"
Exit Sub
End If
Else
Call InitializexmlData
If Not (xmlReadWrite.OpenXML(App.Path & "\config.xml")) Then
MsgBox "讀取配置文件錯誤", vbInformation, "提示"
Exit Sub
End If
End If
ComboFakeCode.Clear
For i = 0 To xmlReadWrite.NodeCount("/junkCode/HexCode") - 1
ComboFakeCode.AddItem (xmlReadWrite.GetChildAttribute("/junkCode/HexCode", "name", i))
Next
ComboFakeCode.Text = ComboFakeCode.List(0)
strFakeCode = xmlReadWrite.GetChildValue("/junkCode/HexCode", 0)
txtSectionName.Text = xmlReadWrite.ReadNode("/junkCode/SectionName")
txtSectionSize.Text = Val(xmlReadWrite.ReadNode("/junkCode/SectionSize"))
chkIsDebuggerPresent.Value = Val(xmlReadWrite.ReadNode("/junkCode/AddIsDebuggerPresent"))
chkModifySectionName.Value = Val(xmlReadWrite.ReadNode("/junkCode/EditSectionName"))
chkBakFile.Value = Val(xmlReadWrite.ReadNode("/junkCode/BackFile"))
chkTopMost.Value = Val(xmlReadWrite.ReadNode("/junkCode/TopMost"))
''調(diào)試
EnableDragDrop Me.hwnd
End Sub
Private Sub Form_Unload(Cancel As Integer)
''調(diào)試
DisableDragDrop Me.hwnd
End Sub
Private Sub LoadxmlSetting()
Dim i As Long
Dim strTemp As String
If Dir(App.Path & "\config.xml") <> "" Then
If Not (xmlReadWrite.OpenXML(App.Path & "\config.xml")) Then
MsgBox "讀取配置文件錯誤", vbInformation, "提示"
Exit Sub
End If
ComboFakeCode.Clear
strTemp = xmlReadWrite.ReadNode("/junkCode/SectionName")
Else
Call InitializexmlData
End If
End Sub
Private Sub LoadxmlHexCode()
Dim i As Long
Dim strTemp As String
If Dir(App.Path & "\config.xml") <> "" Then
If Not (xmlReadWrite.OpenXML(App.Path & "\config.xml")) Then
MsgBox "讀取配置文件錯誤", vbInformation, "提示"
End If
ComboFakeCode.Clear
For i = 0 To xmlReadWrite.NodeCount("/junkCode/HexCode") - 1
ComboFakeCode.AddItem (xmlReadWrite.GetChildAttribute("/junkCode/HexCode", "name", i))
Next
Else
Call InitializexmlData
End If
End Sub
Private Sub InitializexmlData()
Dim FileNumber As Integer
FileNumber = FreeFile
Open App.Path & "\config.xml" For Output As FileNumber
Print #FileNumber, "<?xml version=""1.0"" encoding=""GB2312""?>"
Print #FileNumber, "<!--注釋簡介-->"
Print #FileNumber, "<!--<CodeValue name=""這里添加指令名稱如:花指令1"">這里填寫花指令代碼</CodeValue>-->"
Print #FileNumber, "<junkCode>"
Print #FileNumber, " <HexCode>"
Print #FileNumber, " <SectionName>.kylin</SectionName>"
Print #FileNumber, " <SectionSize>512</SectionSize>"
Print #FileNumber, " <AddIsDebuggerPresent>1</AddIsDebuggerPresent>"
Print #FileNumber, " <EditSectionName>0</EditSectionName>"
Print #FileNumber, " <BackFile>1</BackFile>"
Print #FileNumber, " <TopMost>1</TopMost>"
Print #FileNumber, " <CodeValue name=""EXECryptor 1.x.x -> SoftComplete Developement"">E8240000008B4C240CC70117000100C781B80000000000000031C089411489411880A1C1000000FEC3</CodeValue>"
Print #FileNumber, " <CodeValue name=""ASPack 2.12 -> Alexey Solodovnikov"">60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB0040000061</CodeValue>"
Print #FileNumber, " <CodeValue name="".BJFNT 1.3 -> :MARQUiS:"">EB033A4D3A1EEB02CD209CEB02CD20EB02CD2060619D1F</CodeValue>"
Print #FileNumber, " <CodeValue name=""EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE *"">E8040000008360EB0C5DEB050000000000</CodeValue>"
Print #FileNumber, " </HexCode>"
Print #FileNumber, "</junkCode>"
Close FileNumber
'Call LoadxmlHexCode
End Sub
?? 快捷鍵說明
復(fù)制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -