参考:http://www.mouseos.com/assembly/06.html

参考:http://www.cnblogs.com/tk091/archive/2012/04/18/2456174.html

typedef struct CV_INFO_PDB70
{
    DWORD CvSignature;
    GUID Guid;
    DWORD Age;
    //BYTE PdbFileName[];
    char PdbFilePath[MAX_PATH];
} CV_INFO_PDB70_T;

static const DWORD g_dwTimeStamp = 0x52C652E0;

// 一共有3个地方要replace
int _tmain(int argc, _TCHAR* argv[])
{
    if (argc < 3 || _tcscmp(argv[1], _T("-m")) != 0)
    {
        printf("cmdline format err.\n");
        return 0;
    }

_tprintf(_T("---------------\nprocess file %s.\n"), argv[2]);

FILE *fp;
    fp = _tfopen(argv[2], _T("rb+"));
    if (!fp)
    {
        printf("occur error -1,reason:%d\n", errno);
        return -1;
    }

// IMAGE_NT_HEADER address
    LONG e_lfanew;
    fseek(fp, 0x3c, SEEK_SET);
    fread(&e_lfanew, 4, 1, fp);

// Signature
    DWORD sign;
    fseek(fp, e_lfanew, SEEK_SET);
    fread(&sign, 4, 1, fp);
    if (sign != 0x00004550)
    {
        printf("PE header not matched,sign:%x\n---------------\n", sign);
        fclose(fp);
        return -2;
    }

// IMAGE_FILE_HEADER
    IMAGE_FILE_HEADER ifh;
    fseek(fp, e_lfanew + 4, SEEK_SET);
    fread(&ifh, sizeof(IMAGE_FILE_HEADER), 1, fp);

#ifdef _DEBUG
    printf("IMAGE_FILE_HEADER结构:\n");
    printf("Machine       : %04X\n", ifh.Machine);
    printf("NumberOfSections  : %04X\n", ifh.NumberOfSections);
    printf("TimeDateStamp    : %08X\n", ifh.TimeDateStamp);
    printf("PointerToSymbolTable : %08X\n", ifh.PointerToSymbolTable);
    printf("NumberOfSymbols   : %08X\n", ifh.NumberOfSymbols);
    printf("SizeOfOptionalHeader : %04X\n", ifh.SizeOfOptionalHeader);
    printf("Characteristics   : %04X\n", ifh.Characteristics);
    printf("\n");
#endif

// replace timestamp
    _tprintf(_T("replace %s timestamp,old : %08X, new : %08X.\n"), argv[2], ifh.TimeDateStamp, g_dwTimeStamp);
    ifh.TimeDateStamp = g_dwTimeStamp;
    fseek(fp, e_lfanew + 4, SEEK_SET);
    fwrite((void *)&ifh, sizeof(ifh), 1, fp);

// IMAGE_DIRECTORY_ENTRY_DEBUG
    LONG debugEntryAddr = e_lfanew + 4 + sizeof(IMAGE_FILE_HEADER) + ifh.SizeOfOptionalHeader + (-10) * (long)sizeof(IMAGE_DATA_DIRECTORY);
    fseek(fp, debugEntryAddr, SEEK_SET);

// IMAGE_DATA_DIRECTORY
    IMAGE_DATA_DIRECTORY idd;
    fread(&idd, sizeof(IMAGE_DATA_DIRECTORY), 1, fp);

#ifdef _DEBUG
    printf("IMAGE_DIRECTORY_ENTRY_DEBUG结构:\n");
    printf("VirtualAddress : %08X\n", idd.VirtualAddress);
    printf("Size   : %08X\n", idd.Size);
    printf("IMAGE_DEBUG_DIRECTORY一共有%f个\n", 1.0 * idd.Size / sizeof(IMAGE_DEBUG_DIRECTORY));
    printf("\n");
#endif

// check the address valid or not
    if (idd.VirtualAddress == 0x00 || idd.Size == 0x00)
    {
        _tprintf(_T("Debug information not found in file %s, skip modify debug info.\n---------------\n"), argv[2]);
        fclose(fp);
        return 0;
    }

// IMAGE_DEBUG_DIRECTORY
    IMAGE_DEBUG_DIRECTORY idd2;
    fseek(fp, (WORD)idd.VirtualAddress, SEEK_SET); // need convert virtual address
    fread(&idd2, sizeof(IMAGE_DEBUG_DIRECTORY), 1, fp);

#ifdef _DEBUG
    printf("IMAGE_DEBUG_DIRECTORY结构:\n");
    printf("AddressOfRawData : %08X\n", idd2.AddressOfRawData);
    printf("Characteristics : %08X\n", idd2.Characteristics);
    printf("MajorVersion : %08X\n", idd2.MajorVersion);
    printf("MinorVersion : %08X\n", idd2.MinorVersion);
    printf("PointerToRawData : %08X\n", idd2.PointerToRawData);
    printf("SizeOfData : %08X\n", idd2.SizeOfData);
    printf("TimeDateStamp : %08X\n", idd2.TimeDateStamp);
    printf("Type : %08X\n", idd2.Type);
    printf("\n");
#endif

// replace timestamp
    _tprintf(_T("replace pdb timestamp, old : %08X, new : %08X.\n"), idd2.TimeDateStamp, g_dwTimeStamp);
    idd2.TimeDateStamp = g_dwTimeStamp;
    fseek(fp, (WORD)idd.VirtualAddress, SEEK_SET); // need convert virtual address
    fwrite((void *)&idd2, sizeof(idd2), 1, fp);

// CV_INFO_PDB70
    CV_INFO_PDB70_T cvInfo;
    fseek(fp, idd2.PointerToRawData, SEEK_SET);
    fread(&cvInfo, sizeof(CV_INFO_PDB70_T), 1, fp);

#ifdef _DEBUG
    printf("CV_INFO_PDB70结构:\n");
    printf("Age : %04X\n", cvInfo.Age);
    printf("CvSignature : %04X\n", cvInfo.CvSignature);
    printf("PdbFileName : %s\n", cvInfo.PdbFilePath);
    printf("Guid : %08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X\n",
        cvInfo.Guid.Data1, cvInfo.Guid.Data2, cvInfo.Guid.Data3,
        cvInfo.Guid.Data4[0], cvInfo.Guid.Data4[1], cvInfo.Guid.Data4[2],
        cvInfo.Guid.Data4[3], cvInfo.Guid.Data4[4], cvInfo.Guid.Data4[5],
        cvInfo.Guid.Data4[6], cvInfo.Guid.Data4[7]);
    printf("\n");
#endif

if (cvInfo.CvSignature != 0x53445352)   //RSDS
    {
        printf("pdb signature not matched, CvSignature:%x\n---------------\n", cvInfo.CvSignature);
        fclose(fp);
        return -2;
    }

// replace guid
    printf("replace pdb guid,old : %08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X\n",
        cvInfo.Guid.Data1, cvInfo.Guid.Data2, cvInfo.Guid.Data3, cvInfo.Guid.Data4[0],
        cvInfo.Guid.Data4[1], cvInfo.Guid.Data4[2], cvInfo.Guid.Data4[3], cvInfo.Guid.Data4[4],
        cvInfo.Guid.Data4[5], cvInfo.Guid.Data4[6], cvInfo.Guid.Data4[7]);
    //_tprintf(_T("replace pdb guid,old : %08X-%04X-%04X-%llX\n"), cvInfo.Guid.Data1, cvInfo.Guid.Data2, cvInfo.Guid.Data3, (__int64)cvInfo.Guid.Data4);
    __int64 tmp = 0xdc38466dca416db1;
    cvInfo.Guid.Data1 = 0xf363bf77;
    cvInfo.Guid.Data2 = 0xb00b;
    cvInfo.Guid.Data3 = 0x4fb0;
    memcpy(&cvInfo.Guid.Data4, &tmp, 8);

//_tprintf(_T("replace pdb guid,new : %08X-%04X-%04X-%llX\n"), cvInfo.Guid.Data1, cvInfo.Guid.Data2, cvInfo.Guid.Data3, tmp);
    printf("replace pdb guid,new : %08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X\n",
        cvInfo.Guid.Data1, cvInfo.Guid.Data2, cvInfo.Guid.Data3, cvInfo.Guid.Data4[0],
        cvInfo.Guid.Data4[1], cvInfo.Guid.Data4[2], cvInfo.Guid.Data4[3], cvInfo.Guid.Data4[4],
        cvInfo.Guid.Data4[5], cvInfo.Guid.Data4[6], cvInfo.Guid.Data4[7]);
    fseek(fp, idd2.PointerToRawData, SEEK_SET);
    fwrite((void *)&cvInfo, sizeof(cvInfo), 1, fp);

fclose(fp);

printf("---------------\n");
    //system("pause");
    getchar();

return 0;
}

Make the PE file consistent when code not changed的更多相关文章

  1. PE File.

    Figure 1 - PE File The CLR header stores information to indicate that the PE file is a .NET executab ...

  2. Delphi : Analyze PE file headers?

    Analyze PE file headers? { You'll need a OpenDialog to open a Exe-File and a Memo to show the file i ...

  3. Inject shellcode into PE file

    先声明这是不免杀的,只是演示. 哔哩哔哩视频 新增节 一般能实现特定功能的shellcode的长度都比较长,可以分到几个节上的空白区,但是这样麻烦啊,或者把最后一个节扩大,但是最后一个节一般没有执行的 ...

  4. 《Peering Inside the PE: A Tour of the Win32 Portable Executable File Format》阅读笔记二

    Common Sections The .text section is where all general-purpose code emitted by the compiler or assem ...

  5. dnSpy PE format ( Portable Executable File Format)

    Portable Executable File Format PE Format  微软官方的 What is a .PE file in the .NET framework? [closed] ...

  6. PE Header and Export Table for Delphi

    Malware Analysis Tutorial 8: PE Header and Export Table 2. Background Information of PE HeaderAny bi ...

  7. Reverse Core 第二部分 - 13章 - PE文件格式

    @date: 2016/11/24 @author: dlive ​ PE (portable executable) ,它是微软在Unix平台的COFF(Common Object File For ...

  8. 利用PE数据目录的导入表获取函数名及其地址

    PE文件是以64字节的DOS文件头开始的(IMAGE_DOS_HEADER),接着是一段小DOS程序,然后是248字节的 NT文件头(IMAGE_NT_HEADERS),NT的文件头位置由IMAGE_ ...

  9. Load PE from memory(反取证)(未完)

      Article 1:Loading Win32/64 DLLs "manually" without LoadLibrary() The most important step ...

随机推荐

  1. PAT T1016 Uniqueness of MST

    dfs判断连通块的数量,prim算法建立最小生成树并判断是否唯一~ #include<bits/stdc++.h> using namespace std; ; const int inf ...

  2. 二十一 Struts的数据校验两种方式:手动编码和xml校验

    数据的校验: 一.前台校验:JS校验 JS的校验不是必须的,JS可以被绕行,可以提升用户体验 二.后台校验:编码校验 必须的校验 三.校验的方式: 手动编码(不建议使用) 配置文件(支持) 手动编码的 ...

  3. Just a Hook-HDU1698 区间染色+区间查询

    题意: hook有一根长度为n的棒,可以将它看成有n段,一开始每段都是铜,hook可以选择一段区间改变棒的属性, 棒有三种属性:铜=1,银=2,金=3,最后输出棒每段的属性总和. 链接:http:// ...

  4. c# 字符串比较优化

    一,优化举例 二,浅谈StringComparison 三,C# CultureInfo 类 各国语言对应的区域性名称 一,优化举例 我们在写程序的时候,经常会用到字符串对比.例如:if(IsChec ...

  5. 【剑指Offer面试编程题】题目1355:扑克牌顺子--九度OJ

    题目描述: LL今天心情特别好,因为他去买了一副扑克牌,发现里面居然有2个大王,2个小王(一副牌原本是54张^_^)...他随机从中抽出了5张牌,想测测自己的手气,看看能不能抽到顺子,如果抽到的话,他 ...

  6. python爬虫(三) 用request爬取拉勾网职位信息

    request.Request类 如果想要在请求的时候添加一个请求头(增加请求头的原因是,如果不加请求头,那么在我们爬取得时候,可能会被限制),那么就必须使用request.Request类来实现,比 ...

  7. Spring开发踩坑记录

    #1 @EnableEurekaServer无法正常import原因是spring-cloud-dependencies版本太低,改成高版本的Edgware.SR4即可.参考:https://www. ...

  8. 日常使用SqlServer的笔记

    表操作 查表大小 sp_spaceused 表名 修改表名 ALTER TABLE table RENAME TO NEW_TABLE_NAME; 修改列名 不支持 ALTER TABLE table ...

  9. 三 HTML框架标签

    <!DOCTYPE html> <html> <head> <meta charset="UTF-8"> <title> ...

  10. 如何使用Python输出一个[斐波那契数列]

    如何使用Python输出一个[斐波那契数列]Fibonacci 斐波那契数列(Fibonacci sequence),又称黄金分割数列.因数学家列昂纳多·斐波那契(Leonardoda Fibonac ...