三环PE文件自行加载，并运行，解析PE结构，修复IAT，修复重定位表

// PELoad.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//

#include <iostream>
#include <windows.h>
#include <tchar.h>

IMAGE_DOS_HEADER DOSheader;
IMAGE_NT_HEADERS NTHeader;
PVOID ModuleBase;


void FixBaseRelocTable(PVOID ModuleBase)
{
    int    OriginalImageBase;
    int    uRelocTableSize;
    int* uRelocAddress;
    int    uIndex;
    IMAGE_DATA_DIRECTORY    ImageDataDirectory;
    IMAGE_BASE_RELOCATION* pImageBaseRelocation;

    //定位到可选PE头里拿到ImageBase
    OriginalImageBase = NTHeader.OptionalHeader.ImageBase;
    //定位到可选PE头的DataDirArray里的重定位表
    ImageDataDirectory = NTHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];
    //重定位表的实际地址
    pImageBaseRelocation = (PIMAGE_BASE_RELOCATION)((ULONG)ModuleBase + ImageDataDirectory.VirtualAddress);
    if (pImageBaseRelocation == NULL)
    {
        return;
    }
    while (pImageBaseRelocation->SizeOfBlock)
    {
        typedef struct
        {
            USHORT offset : 12;
            USHORT type : 4;
        }TypeOffset;
        TypeOffset* pTypeOffset = (TypeOffset*)(pImageBaseRelocation + 1);
        uRelocTableSize = (pImageBaseRelocation->SizeOfBlock - 8) / 2;
        for (uIndex = 0; uIndex < uRelocTableSize; uIndex++)
        {

            if (pTypeOffset[uIndex].type == 3)
            {
                uRelocAddress = (int*)(pTypeOffset[uIndex].offset + pImageBaseRelocation->VirtualAddress + (int)ModuleBase);
                //printf("%x\n", *uRelocAddress);
                *uRelocAddress = (int)ModuleBase + (*uRelocAddress - OriginalImageBase);
            }
        }
        pImageBaseRelocation = (IMAGE_BASE_RELOCATION*)((ULONG)pImageBaseRelocation + pImageBaseRelocation->SizeOfBlock);
    }

    
}

void FixIAT(PVOID ModuleBase)
{
    IMAGE_DATA_DIRECTORY    ImageDataDirectory;
    
    PIMAGE_IMPORT_DESCRIPTOR ImportTable;

    ImageDataDirectory = NTHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];

    ImportTable = PIMAGE_IMPORT_DESCRIPTOR(ImageDataDirectory.VirtualAddress + (int)ModuleBase);

    int i = 0;

    while (ImportTable->Name)
    {
        char* dllname = (char*)((int)ModuleBase + ImportTable->Name);

        HMODULE hMoudle = LoadLibraryA((LPCSTR)dllname);

        printf("%s\n", dllname);

        int structaddr =ImportTable->OriginalFirstThunk + (int)ModuleBase;

        IMAGE_IMPORT_BY_NAME* FirtstINT = (IMAGE_IMPORT_BY_NAME*)(*(DWORD*)structaddr+(int)ModuleBase);

        IMAGE_THUNK_DATA* FirtstThunk = (IMAGE_THUNK_DATA*)(ImportTable->FirstThunk + (int)ModuleBase);

        while (FirtstThunk->u1.Ordinal)
        {
            if (FirtstThunk->u1.Ordinal& IMAGE_ORDINAL_FLAG32)
            {
                FirtstThunk->u1.Ordinal = DWORD (GetProcAddress(hMoudle, (char*)((FirtstThunk->u1.Ordinal << 0x1) >> 0x1)));
            } 
            else
            {
                char* FuncName = (char*)(FirtstINT->Name);
                printf("%s\n", FuncName);
                FirtstThunk->u1.Ordinal = DWORD(GetProcAddress(hMoudle, FuncName));
            }
            structaddr += 4;
            FirtstINT = (IMAGE_IMPORT_BY_NAME*)(*(DWORD*)structaddr + (int)ModuleBase);
            FirtstThunk++;
        }

        i++;

        *ImportTable = ImportTable[i];
    }



}

void LoadFileToMemory(LPCWSTR FileName)
{
    
    BOOL Istrue;
    DWORD Bytes;
    HANDLE hFile;
    PVOID SectionBuff;
    OVERLAPPED overlap;
    memset(&overlap, 0, sizeof(overlap));
    // Open the file for overlapped reads
    hFile = CreateFile(FileName,
                    GENERIC_READ,
                    FILE_SHARE_READ | FILE_SHARE_WRITE,
                    NULL,
                    OPEN_EXISTING,
                    FILE_FLAG_OVERLAPPED,
                    NULL);
    if (hFile == INVALID_HANDLE_VALUE)
    {
        printf("打开文件失败！\n");
        return;
    }

    ReadFile(hFile, &DOSheader, sizeof(IMAGE_DOS_HEADER), &Bytes, &overlap);

    overlap.Offset = DOSheader.e_lfanew;

    ReadFile(hFile, &NTHeader, sizeof(IMAGE_NT_HEADERS), &Bytes, &overlap);

    WORD SectionNumber = NTHeader.FileHeader.NumberOfSections;

    IMAGE_SECTION_HEADER* Sections = (IMAGE_SECTION_HEADER*)VirtualAlloc(NULL,sizeof(IMAGE_SECTION_HEADER)*SectionNumber,MEM_COMMIT,PAGE_READWRITE);

    overlap.Offset = DOSheader.e_lfanew+ sizeof(IMAGE_NT_HEADERS);

    ReadFile(hFile, Sections, sizeof(IMAGE_SECTION_HEADER) * SectionNumber, &Bytes, &overlap);

    ModuleBase = VirtualAlloc(NULL, NTHeader.OptionalHeader.SizeOfImage, MEM_COMMIT, PAGE_READWRITE);

    if (ModuleBase == 0)
    {
        printf("申请内存失败！\n");
        return;
    }

    memcpy(ModuleBase, &DOSheader, sizeof(DOSheader));

    memcpy((PVOID)((int)ModuleBase+DOSheader.e_lfanew), &NTHeader, sizeof(NTHeader));

    memcpy((PVOID)((int)ModuleBase + DOSheader.e_lfanew+sizeof(IMAGE_NT_HEADERS)), (PVOID)Sections, sizeof(IMAGE_SECTION_HEADER) * SectionNumber);


    //依次COPY 各区段数据
    int SectionSize;

    for (int i = 0; i < SectionNumber; i++)
    {
        PVOID SectionVirtualAddress = (PVOID) Sections[i].VirtualAddress;//对应区段相对偏移
        if (Sections[i].Misc.VirtualSize > Sections[i].SizeOfRawData)
            SectionSize = Sections[i].Misc.VirtualSize;//取最大的占用空间
        else
            SectionSize = Sections[i].SizeOfRawData;

        SectionBuff = VirtualAlloc(NULL, SectionSize, MEM_COMMIT, PAGE_READWRITE);

        overlap.Offset = Sections[i].PointerToRawData;

        ReadFile(hFile, SectionBuff, SectionSize, &Bytes, &overlap);

        memcpy((PVOID)((int)ModuleBase + (int)SectionVirtualAddress), SectionBuff, SectionSize);

        VirtualFree(SectionBuff, SectionSize, MEM_RELEASE);
        
    }
    
    VirtualFree(Sections, sizeof(IMAGE_SECTION_HEADER) * SectionNumber, MEM_RELEASE);

    FixBaseRelocTable(ModuleBase);

    FixIAT(ModuleBase);


}

int main()
{
    const wchar_t* FileName = L"D:\\MyProjects\\test\\Debug\\哈哈哈.exe";

    LoadFileToMemory((LPCWSTR)FileName);


    DWORD* OEP = (DWORD*)((DWORD)ModuleBase + NTHeader.OptionalHeader.AddressOfEntryPoint);

    

    DWORD OldProtect;

    OldProtect = 0;

    BOOL istrue = VirtualProtect(ModuleBase, NTHeader.OptionalHeader.SizeOfImage, PAGE_EXECUTE_READWRITE, &OldProtect);

    printf("111111111111111");

    _asm 
    {

        pushad
        pushfd

        call OEP

        popfd
        popad

    }

    return 0;
}