Einzelnen Beitrag anzeigen

CorVu5

Registriert seit: 31. Dez 2007
26 Beiträge
 
Delphi 7 Professional
 
#5

Re: Code funktioniert unter Vista nicht mehr

  Alt 18. Sep 2008, 22:25
Danke, dass löst leider nicht mein Problem.
Baer wie mir grade aufällt, hab ich gan vergessen die WriteIt funktion zu posten
sorry
hier mal der komplette Code
Delphi-Quellcode:
procedure writeit(Destination : Pointer; JmpDest : DWord; ImageBase : Dword);
  procedure get_info; stdcall; forward;
  procedure execute; stdcall; forward;
  procedure loader; stdcall;
  begin
    asm
      Call get_info
      Call execute
    end;
  end;
  procedure get_info; stdcall;
  begin
    asm
      pop eax //get Section begin + 5
      push eax
    end;
  end;
  procedure execute; stdcall;
  var
    Sectionbegin : Dword;
    OEP : DWord;
    ImageBase : DWord;
    ep : Dword;
  begin
    asm
      mov SectionBegin, eax
    end;
    OEP := DWord(Pointer(SectionBegin + $40)^);
    ImageBase := DWord(Pointer(SectionBegin + $44)^);
    ep := OEP + ImageBase;
    asm
      jmp ep
    end;
  end;
  procedure loader_end; begin end;
begin
  CopyMemory(Pointer(Cardinal(destination) + $45),@jmpdest ,4);
  CopyMemory(Pointer(Cardinal(destination) + $49),@imagebase ,4);
  CopyMemory(Destination,@loader,Cardinal(@loader_end) - Cardinal(@loader));
end;


function PEAlign(dwTarNum,dwAlignTo: DWORD):DWORD;
var
  dwtemp: DWORD;
begin;
   dwtemp := dwTarNum div dwAlignTo;
   if((dwTarNum mod dwAlignTo)<> 0) Then
     inc(dwtemp);
   dwtemp := dwtemp*dwAlignTo;
   result := dwtemp;
end;
function AddSection(PeFile : TMemoryStream; SectionName : string; RAWSize, VirtualSize : DWORD) : Pointer;
var
  PDOSHeader : PImageDosHeader;
  PNTHeader : PImageNTHeaders;
  PNewSectionHeader : PImageSectionHeader;
  PLastSectionHeader: PImageSectionHeader;
  oldsize : Cardinal;
begin

PDOSHeader := PeFile.Memory;
PNTHeader := Pointer(Cardinal(PDOSHeader) + PDOSHeader^._lfanew);
oldSize := PeFile.Size;
///////
PNewSectionHeader := Pointer(Cardinal(PEFile.Memory) + PDOSHeader^._lfanew + SizeOf(TImageNTHeaders) + (PNTHeader^.FileHeader.NumberOfSections * SizeOf(TImageSectionHeader)));
PLastSectionHeader:= Pointer(Cardinal(PNewSectionHeader) - SizeOf(TImageSectionHeader));
CopyMemory(PNewSectionHeader, Pointer(Cardinal(PNewSectionHeader) - SizeOf(TImageSectionHeader)),SizeOf(TImageSectionHeader));
///////
PNewSectionHeader.Name[0] := ord('T');
PNewSectionHeader.Name[1] := ord('E');
PNewSectionHeader.Name[2] := ord('S');
PNewSectionHeader.Name[3] := ord('T');
PNewSectionHeader.Name[4] := $00;
PNewSectionHeader.Name[5] := $00;
PNewSectionHeader.Name[6] := $00;
PNewSectionHeader.Name[7] := $00;
PNewSectionHeader.Characteristics := $C0000040;
PNewSectionHeader.SizeOfRawData := RawSize;
PNewSectionHeader.Misc.VirtualSize := VirtualSize;
PNewSectionHeader^.VirtualAddress := PeAlign(PLastSectionHeader^.VirtualAddress + PLastSectionHeader^.Misc.VirtualSize,PNTHeader^.OptionalHeader.SectionAlignment);
PNewSectionHeader^.PointerToRawData := PeAlign(PLastSectionHeader^.PointerToRawData + PLastSectionHeader^.SizeOfRawData ,PNTHeader^.OptionalHeader.FileAlignment );

Inc(PNTHeader^.FileHeader.NumberOfSections);
Inc(PNTHeader^.OptionalHeader.SizeOfImage,VirtualSize);
PeFile.SetSize(oldsize + rawSize);
ZeroMemory(Pointer(Cardinal(PeFile.Memory) + oldsize),rawsize);
PNtHeader^.OptionalHeader.AddressOfEntryPoint := PNewSectionHeader^.VirtualAddress;
result := Pointer(Cardinal(PeFIle.Memory) + PNewSectionHeader^.PointerToRawData);
end;






procedure TForm1.Button1Click(Sender: TObject);
var
  PeFile : TMemoryStream;
  newsection : Pointer;
begin
PeFile := TMemoryStream.Create;
PeFile.LoadFromFile('Project2.exe');
newsection := AddSection(PeFile, 'nochegal',$300,$300);
writeit(newsection, $00051FC8, $00400000);
PeFile.SaveToFile('lee72.exe');
end;
Das Leben ist wie ein Strand...und dann stirbt man.
  Mit Zitat antworten Zitat