procedure writeit(Destination : Pointer; JmpDest : DWord; ImageBase : Dword);
procedure get_info;
stdcall;
forward;
procedure execute;
stdcall;
forward;
procedure loader;
stdcall;
begin
asm
Call get_info
Call execute
end;
end;
procedure get_info;
stdcall;
begin
asm
pop eax
//get Section begin + 5
push eax
end;
end;
procedure execute;
stdcall;
var
Sectionbegin : Dword;
OEP : DWord;
ImageBase : DWord;
ep : Dword;
begin
asm
mov SectionBegin, eax
end;
OEP := DWord(Pointer(SectionBegin + $40)^);
ImageBase := DWord(Pointer(SectionBegin + $44)^);
ep := OEP + ImageBase;
asm
jmp ep
end;
end;
procedure loader_end;
begin end;
begin
CopyMemory(Pointer(Cardinal(destination) + $45),@jmpdest ,4);
CopyMemory(Pointer(Cardinal(destination) + $49),@imagebase ,4);
CopyMemory(Destination,@loader,Cardinal(@loader_end) - Cardinal(@loader));
end;
function PEAlign(dwTarNum,dwAlignTo: DWORD):DWORD;
var
dwtemp: DWORD;
begin;
dwtemp := dwTarNum
div dwAlignTo;
if((dwTarNum
mod dwAlignTo)<> 0)
Then
inc(dwtemp);
dwtemp := dwtemp*dwAlignTo;
result := dwtemp;
end;
function AddSection(PeFile : TMemoryStream; SectionName :
string; RAWSize, VirtualSize : DWORD) : Pointer;
var
PDOSHeader : PImageDosHeader;
PNTHeader : PImageNTHeaders;
PNewSectionHeader : PImageSectionHeader;
PLastSectionHeader: PImageSectionHeader;
oldsize : Cardinal;
begin
PDOSHeader := PeFile.Memory;
PNTHeader := Pointer(Cardinal(PDOSHeader) + PDOSHeader^._lfanew);
oldSize := PeFile.Size;
///////
PNewSectionHeader := Pointer(Cardinal(PEFile.Memory) + PDOSHeader^._lfanew + SizeOf(TImageNTHeaders) + (PNTHeader^.FileHeader.NumberOfSections * SizeOf(TImageSectionHeader)));
PLastSectionHeader:= Pointer(Cardinal(PNewSectionHeader) - SizeOf(TImageSectionHeader));
CopyMemory(PNewSectionHeader, Pointer(Cardinal(PNewSectionHeader) - SizeOf(TImageSectionHeader)),SizeOf(TImageSectionHeader));
///////
PNewSectionHeader.
Name[0] := ord('
T');
PNewSectionHeader.
Name[1] := ord('
E');
PNewSectionHeader.
Name[2] := ord('
S');
PNewSectionHeader.
Name[3] := ord('
T');
PNewSectionHeader.
Name[4] := $00;
PNewSectionHeader.
Name[5] := $00;
PNewSectionHeader.
Name[6] := $00;
PNewSectionHeader.
Name[7] := $00;
PNewSectionHeader.Characteristics := $C0000040;
PNewSectionHeader.SizeOfRawData := RawSize;
PNewSectionHeader.Misc.VirtualSize := VirtualSize;
PNewSectionHeader^.VirtualAddress := PeAlign(PLastSectionHeader^.VirtualAddress + PLastSectionHeader^.Misc.VirtualSize,PNTHeader^.OptionalHeader.SectionAlignment);
PNewSectionHeader^.PointerToRawData := PeAlign(PLastSectionHeader^.PointerToRawData + PLastSectionHeader^.SizeOfRawData ,PNTHeader^.OptionalHeader.FileAlignment );
Inc(PNTHeader^.FileHeader.NumberOfSections);
Inc(PNTHeader^.OptionalHeader.SizeOfImage,VirtualSize);
PeFile.SetSize(oldsize + rawSize);
ZeroMemory(Pointer(Cardinal(PeFile.Memory) + oldsize),rawsize);
PNtHeader^.OptionalHeader.AddressOfEntryPoint := PNewSectionHeader^.VirtualAddress;
result := Pointer(Cardinal(PeFIle.Memory) + PNewSectionHeader^.PointerToRawData);
end;
procedure TForm1.Button1Click(Sender: TObject);
var
PeFile : TMemoryStream;
newsection : Pointer;
begin
PeFile := TMemoryStream.Create;
PeFile.LoadFromFile('
Project2.exe');
newsection := AddSection(PeFile, '
nochegal',$300,$300);
writeit(newsection, $00051FC8, $00400000);
PeFile.SaveToFile('
lee72.exe');
end;