编写一段rust程序实现PE文件的操作,并修改 a.exe 的 .text 区段名为 .mytext
use std::fs;
use std::io;
use std::io::Write;
use std::mem;
use std::slice;
#[repr(C)]
struct IMAGE_DOS_HEADER {
e_magic: u16,
e_cblp: u16,
e_cp: u16,
e_crlc: u16,
e_cparhdr: u16,
e_minalloc: u16,
e_maxalloc: u16,
e_ss: u16,
e_sp: u16,
e_csum: u16,
e_ip: u16,
e_cs: u16,
e_lfarlc: u16,
e_ovno: u16,
e_res: [u16; 4],
e_oemid: u16,
e_oeminfo: u16,
e_res2: [u16; 10],
e_lfanew: u32,
}
#[repr(C)]
struct IMAGE_FILE_HEADER {
Machine: u16,
NumberOfSections: u16,
TimeDateStamp: u32,
PointerToSymbolTable: u32,
NumberOfSymbols: u32,
SizeOfOptionalHeader: u16,
Characteristics: u16,
}
#[repr(C)]
struct IMAGE_SECTION_HEADER {
Name: [u8; 8],
VirtualSize: u32,
VirtualAddress: u32,
SizeOfRawData: u32,
PointerToRawData: u32,
PointerToRelocations: u32,
PointerToLinenumbers: u32,
NumberOfRelocations: u16,
NumberOfLinenumbers: u16,
Characteristics: u32,
}
fn main() -> io::Result<()> {
let mut file = fs::OpenOptions::new().read(true).write(true).open("a.exe")?;
let size = file.metadata()?.len();
let mut buffer = vec![0; size as usize];
file.read_exact(&mut buffer)?;
let dos_header: &mut IMAGE_DOS_HEADER = unsafe { mem::transmute(&mut buffer[0]) };
let nt_header_offset = dos_header.e_lfanew as usize;
let file_header: &mut IMAGE_FILE_HEADER =
unsafe { mem::transmute(&mut buffer[nt_header_offset + 4]) };
let section_header_offset = nt_header_offset + mem::size_of::<IMAGE_FILE_HEADER>();
let section_header_size = mem::size_of::<IMAGE_SECTION_HEADER>();
let section_count = file_header.NumberOfSections as usize;
for i in 0..section_count {
let section_header = unsafe {
mem::transmute::<*mut u8, *mut IMAGE_SECTION_HEADER>(
&mut buffer[section_header_offset + i * section_header_size],
)
};
let name = unsafe { slice::from_raw_parts_mut(section_header.Name.as_mut_ptr(), 8) };
if name == b".text\0\0\0" {
let mytext = b".mytext\0";
name.copy_from_slice(mytext);
section_header.VirtualAddress = 0x2000; // 修改 .mytext 的虚拟地址
section_header.PointerToRawData = 0x400; // 修改 .mytext 的文件偏移
}
}
file.write_all(&buffer)?;
Ok(())
}
原文地址: https://www.cveoy.top/t/topic/vpv 著作权归作者所有。请勿转载和采集!