delphi版本修改PE头源码
//VC++6外衣 1
OEPCODEFIVE: THEAD =
($55, $8B, $EC, $6A, $FF, $68, $00, $00, $00, $00, $68, $00, $00, $00, $00, $64,
$A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $83, $EC, $68,
$53, $56, $57, $58, $58, $58, $83, $C4, $68, $58, $67, $64, $A3, $00, $00, $58,
$58, $58, $58, $8B, $E8, $E9, $07, $B9, $FE, $FF, $00, $00, $00, $00, $00, $00);
//VC++6外衣 2
OEPCODEFIVE: THEAD =
($55, $8B, $EC, $6A, $FF, $68, $00, $00, $00, $00, $68, $00, $00, $00, $00, $64,
$A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $83, $EC, $68,
$53, $56, $57, $58, $58, $58, $83, $C4, $68, $58, $67, $64, $A3, $00, $00, $58,
$58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00);
1.直接将入口地址赋给寄存器eax,然后jmp eax
0046902A B8 304A4500 mov eax,Project1.00454A30
0046902F FFE0 jmp eax
00469031 90 nop
2. 直接跳转到入口地址
00469124 - E9 07B9FEFF jmp Project1.00454A30
两种效果实际上是一样的,但我们为了方便修改花指令跳转到原来的入口地址，通常取得原
pe header的AddressOfEntryPoint,然后给寄存器eax保存改值，所以第二种方法就不太方便，
所以一般采用第一种方法，JMPOFF为花指令代码到跳转指令的偏移，如对Visual C++的花指令
JMPOFF=54,其后免跟的是原入口地址，可以随便填写，程序加花指令是会自动修改，一般可以
默认设为00104000(即00401000).
通过汇编修改花指令跳转原入口地址的语句:
asm //这里说明一下，这是嵌入的汇编代码,寄存器—CPU暂时储存数据的东西，比内存更快，以提高效率
PUSHAD
LEA eax, OEPCODE //将OEPCODE的地址交给寄存器
ADD eax, JMPOFF //添加JMPOFF值给寄存器
MOV edx, AddressOfEntryPoint //转移指令，相当于付值语句，左边给右边
MOV DWORD ptr [eax], edx //同上
POPAD
end;
}
unit Unit1;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls, ExtCtrls, ShellAPI;
type
TForm1 = class(TForm)
Label1: TLabel;
Edit1: TEdit;
Button1: TButton;
RadioGroup1: TRadioGroup;
Label2: TLabel;
Edit2: TEdit;
Label3: TLabel;
Edit3: TEdit;
CheckBox1: TCheckBox;
Button2: TButton;
Label5: TLabel;
OpenDialog1: TOpenDialog;
Label4: TLabel;
procedure Button1Click(Sender: TObject);
procedure obtain;
procedure Button2Click(Sender: TObject);
procedure Label4Click(Sender: TObject);
procedure Edit3KeyPress(Sender: TObject; var Key: Char);
private
{ Private declarations }
FImageBase: DWORD;
procedure SetOepCode;
public
{ Public declarations }
end;
THEAD = array[0..63] of byte;
var
Form1: TForm1;
const
{MYSECTION = 'Fi7ke'; //添加的节名，自定义
JMPOFF = 43; //花指令的机器码,Ollydbg加载后随便取
//Microsoft Visual C++
OEPCODE: THEAD =
($55, $8B, $EC, $6A, $FF, $68, $2A, $2C, $0A, $00, $68, $38,
$90, $0D, $00, $64, $A1, $00, $00, $00, $00, $50, $64, $89,
$25, $00, $00, $00, $00, $58, $64, $A3, $00, $00, $00, $00,
$58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF,
$E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,
$00, $00, $00, $00); }
//Nothing found * one
OEPCODEONE: THEAD =
($55, $8B, $EC, $83, $C4, $F4, $83, $C4, $0C, $B8, $00, $10, $40, $00, $50, $C3,
$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,
$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,
$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00);
//Nothing found * two
OEPCODETWO: THEAD =
($55, $8B, $EC, $41, $52, $90, $5A, $49, $5D, $41, $B8, $00, $10, $40, $00, $FF,
$E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,
$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,
$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00);
//VC++外衣
OEPCODETHREE: THEAD =
($55, $8B, $EC, $6A, $FF, $68, $2A, $2C, $0A, $00, $68, $38, $90, $0D, $00, $64,
$A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $58, $64, $A3,
$00, $00, $00, $00, $58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF,
$E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00);
//VC++5外衣
OEPCODEFOUR: THEAD =
($55, $8B, $EC, $6A, $FF, $68, $48, $54, $41, $00, $68, $A8, $21, $40, $00, $64,
$A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $83, $C4, $94,
$53, $56, $57, $00, $00, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00,
$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00);
//VC++6外衣
OEPCODEFIVE: THEAD =
($55, $8B, $EC, $6A, $FF, $68, $00, $00, $00, $00, $68, $00, $00, $00, $00, $64,
$A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $83, $EC, $68,
$53, $56, $57, $58, $58, $58, $83, $C4, $68, $58, $67, $64, $A3, $00, $00, $58,
$58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00);
//C外衣
OEPCODESIX: THEAD =
($55, $8B, $EC, $6A, $FF, $68, $11, $11, $11, $00, $68, $22, $22, $22, $00, $64,
$A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $58, $64, $A3,
$00, $00, $00, $00, $58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF,
$E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00);
OepCount = 6;
//OEPCODEARRAY :array[0..OepCount-1,0..63] of byte=(
//OEPCODEARRAY :array[0..OepCount-1] of array[0..63] of byte=(
OEPCODEARRAY :array[0..OepCount-1] of THEAD=(
($55, $8B, $EC, $83, $C4, $F4, $83, $C4, $0C, $B8, $00, $10, $40, $00, $50, $C3,
$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,
$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,
$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00), //Nothing found * one
($55, $8B, $EC, $6A, $FF, $68, $2A, $2C, $0A, $00, $68, $38, $90, $0D, $00, $64,
$A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $58, $64, $A3,
$00, $00, $00, $00, $58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF,
$E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00), //VC++外衣
($55, $8B, $EC, $6A, $FF, $68, $48, $54, $41, $00, $68, $A8, $21, $40, $00, $64,
$A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $83, $C4, $94,
$53, $56, $57, $00, $00, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00,
$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00), //VC++5外衣
($55, $8B, $EC, $6A, $FF, $68, $00, $00, $00, $00, $68, $00, $00, $00, $00, $64,
$A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $83, $EC, $68,
$53, $56, $57, $58, $58, $58, $83, $C4, $68, $58, $67, $64, $A3, $00, $00, $58,
$58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF, $E0, $90, $00, $00, $00), //VC++6外衣
($55, $8B, $EC, $6A, $FF, $68, $11, $11, $11, $00, $68, $22, $22, $22, $00, $64,
$A1, $00, $00, $00, $00, $50, $64, $89, $25, $00, $00, $00, $00, $58, $64, $A3,
$00, $00, $00, $00, $58, $58, $58, $58, $8B, $E8, $B8, $00, $10, $40, $00, $FF,
$E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00), //C外衣
($55, $8B, $EC, $41, $52, $90, $5A, $49, $5D, $41, $B8, $00, $10, $40, $00, $FF,
$E0, $90, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,
$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00,
$00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00) //Nothing found * two
);
JMPOFFARRAY :array[0..OepCount-1] of integer=(10,43,38,54,43,11);
{Nothing found * ONE：
Borland Delphi 6.0 - 7.0
00469022 0055 8B add byte ptr ss:[ebp-75],dl
00469025 EC in al,dx
00469026 83C4 F4 add esp,-0C
00469029 83C4 0C add esp,0C
0046902C B8 304A4500 mov eax,Project1.00454A30
00469031 50 push eax
00469032 C3 retn
Nothing found * TWO
00454A72 55 push ebp
00454A73 8BEC mov ebp,esp
00454A75 41 inc ecx
00454A76 52 push edx
00454A77 90 nop
00454A78 5A pop edx
00454A79 49 dec ecx
00454A7A 5D pop ebp
00454A7B 41 inc ecx
0046902A B8 304A4500 mov eax,Project1.00454A30
0046902F FFE0 jmp eax
00469031 90 nop
C外衣：
00454A6C 55 push ebp
00454A6D 8BEC mov ebp,esp
00454A6F 6A FF push -1
00454A71 68 11111100 push 111111
00454A76 68 22222200 push 222222
00454A7B 64:A1 00000>mov eax,dword ptr fs:[0]
00454A81 50 push eax
00454A82 64:8925 000>mov dword ptr fs:[0],esp
00454A89 58 pop eax
00454A8A 64:A3 00000>mov dword ptr fs:[0],eax
00454A90 58 pop eax
00454A91 58 pop eax
00454A92 58 pop eax
00454A93 58 pop eax
00454A94 8BE8 mov ebp,eax
00454A96 - E9 65F5CAFF jmp 00104000
VC++5外衣:
0046905F P> 55 push ebp
00469060 8BEC mov ebp,esp
00469062 6A FF push -1
00469064 68 48544100 push Project1.00415448
00469069 68 A8214000 push Project1.004021A8
0046906E 64:A1 0000000>mov eax,dword ptr fs:[0]
00469074 50 push eax
00469075 64:8925 00000>mov dword ptr fs:[0],esp
0046907C 83C4 94 add esp,-6C
0046907F 53 push ebx
00469080 56 push esi
00469081 57 push edi
00469082 0000 add byte ptr ds:[eax],al
0046902A B8 304A4500 mov eax,Project1.00454A30
0046902F FFE0 jmp eax
00469031 90 nop
VC++外衣：
00469000 P> 55 push ebp
00469001 8BEC mov ebp,esp
00469003 6A FF push -1
00469005 68 2A2C0A00 push 0A2C2A
0046900A 68 38900D00 push 0D9038
0046900F 64:A1 0000000>mov eax,dword ptr fs:[0]
00469015 50 push eax
00469016 64:8925 00000>mov dword ptr fs:[0],esp
0046901D 58 pop eax
0046901E 64:A3 0000000>mov dword ptr fs:[0],eax
00469024 58 pop eax
00469025 58 pop eax
00469026 58 pop eax
00469027 58 pop eax
00469028 8BE8 mov ebp,eax
0046902A B8 304A4500 mov eax,Project1.00454A30
0046902F FFE0 jmp eax
00469031 90 nop
VC++6外衣：
004690EF P> 55 push ebp
004690F0 8BEC mov ebp,esp
004690F2 6A FF push -1
004690F4 68 00000000 push 0
004690F9 68 00000000 push 0
004690FE 64:A1 0000000>mov eax,dword ptr fs:[0]
00469104 50 push eax
00469105 64:8925 00000>mov dword ptr fs:[0],esp
0046910C 83EC 68 sub esp,68
0046910F 53 push ebx
00469110 56 push esi
00469111 57 push edi
00469112 58 pop eax
00469113 58 pop eax
00469114 58 pop eax
00469115 83C4 68 add esp,68
00469118 58 pop eax
00469119 67:64:A3 0000 mov dword ptr fs:[0],eax
0046911E 58 pop eax
0046911F 58 pop eax
00469120 58 pop eax
00469121 58 pop eax
00469122 8BE8 mov ebp,eax
0046902A B8 304A4500 mov eax,Project1.00454A30
0046902F FFE0 jmp eax
00469031 90 nop
}
function IntToHex(Int: Int64; IntSize: Byte): String;
procedure AddSection(FName,MySection: string;SecSize:DWord);
implementation
{$R *.dfm}
var
OEPCODE: THEAD;
JMPOFF :integer;
function IntToHex(Int: Int64; IntSize: Byte): String;
const
HexChars: array[0..15] of Char = ('0', '1', '2', '3', '4', '5','6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f');
var
n: Byte;
begin
Result := '';
for n := 0 to IntSize - 1 do
begin
Result := HexChars[Int and $F] + Result;
Int := Int shr $4;
end;
end;
procedure AddSection(FName,MySection: string;SecSize:DWord);
var
DOSHEADER: IMAGE_DOS_HEADER; //DOS MZ header
PEHEADER: IMAGE_NT_HEADERS; //PE header
SectionHeader: IMAGE_SECTION_HEADER; //节表
MySectionHeader: IMAGE_SECTION_HEADER; //自定义节表
fs: TFileStream;
AddressOfEntryPoint: DWORD; //入口点
i:integer;
begin
fs := TFileStream.Create(FName, fmOpenReadWrite +
fmShareDenyWrite);
try
{Tstream中定义的虚方法有四个：
1、Read:此方法实现将数据从流中读出。函数原形为：
Function Read(var Buffer;Count:Longint):Longint;virtual;abstract;
参数Buffer为数据读出时放置的缓冲区，Count为需要读出的数据的字节数，该方法返回值为实际读出的字节数，它可以小于或等于Count中指定的值。
2、Write:此方法实现将数据写入流中。函数原形为：
Function Write(var Buffer;Count:Longint):Longint;virtual;abstract;
参数Buffer为将要写入流中的数据的缓冲区，Count为数据的长度字节数，该方法返回值为实际写入流中的字节数。
3、Seek:此方法实现流中读取指针的移动。函数原形为：
Function Seek(Offset:Longint;Origint:Word):Longint;virtual;abstract;
参数Offset为偏移字节数,参数Origint指出Offset的实际意义，其可能的取值如下：
soFromBeginning:Offset为移动后指针距离数据开始的位置。此时Offset必须大于或者等于零。
soFromCurrent:Offset为移动后指针与当前指针的相对位置。
soFromEnd:Offset为移动后指针距离数据结束的位置。此时Offset必须小于或者等于零。该方法返回值为移动后指针的位置。
4、Setsize:此方法实现改变数据的大小。函数原形为：
Function Setsize(NewSize:Longint);virtual; }
//将指针偏移量放到文件头部
fs.Seek(0, soFromBeginning);
//读取DOS头信息
fs.Read(DOSHEADER, sizeof(DOSHEADER));
//DOS MZ header 又命名为 IMAGE_DOS_HEADER.。其中只有两个域比较重要:
//e_magic 包含字符串"MZ"，e_lfanew 包含PE header在文件中的偏移量。
//将指针移到PE header在文件中的偏移量
fs.Seek(DOSHEADER._lfanew, soFromBeginning);
//读取PE header头信息
fs.Read(PEHEADER, sizeOf(PEHEADER));
//PEHEADER.FileHeader.NumberOfSections:文件的节数目。如果我们要在文件中增加或删除一个节，就需要修改这个值。
//将指针移到节表在当前位置的相对偏移量
fs.Seek(sizeOf(SectionHeader) *
(PEHEADER.FileHeader.NumberOfSections - 1), soFromCurrent);
//读取节表的信息
fs.Read(SectionHeader, sizeof(IMAGE_SECTION_HEADER));
//节名长不超过8字节。记住节名仅仅是个标记而已,我们选择任何名字甚至空着也行
{ MySectionHeader.Name[0] := ord('F');
MySectionHeader.Name[1] := ord('i');
MySectionHeader.Name[2] := ord('7');
MySectionHeader.Name[3] := ord('k');
MySectionHeader.Name[4] := ord('e');
MySectionHeader.Name[5] := 0;
MySectionHeader.Name[6] := 0;
MySectionHeader.Name[7] := 0; }
for i:=0 to 7 do
begin
MySectionHeader.Name[i] :=0;
if i<length(MySection) then
MySectionHeader.Name[i] :=Ord(MySection[i+1]);
end;
//VirtualAddress 本节的RVA（相对虚拟地址）。PE装载器将节映射至内存时会读取本值，因此如果域值是1000h，
//而PE文件装在地址400000h处，那么本节就被载到401000h。
//SizeOfImage 内存中整个PE映像体的尺寸。它是所有头和节经过节对齐处理后的大小。
MySectionHeader.VirtualAddress := PEHEADER.OptionalHeader.SizeOfImage;
//节的大小 $200十六进制 ＝ 512字节 最好大于 512 不然可能会出错
//MySectionHeader.Misc.VirtualSize := $200;
MySectionHeader.Misc.VirtualSize := SecSize; //StrToInt(IntToHex(SecSize,sizeof(SecSize)));
//SizeOfRawData 经过文件对齐处理后节尺寸，PE装载器提取本域值了解需映射入内存的节字节数。
//（译者注: 假设一个文件的文件对齐尺寸是0x200，如果前面的 VirtualSize域指示本节长度是0x388字节，
//则本域值为0x400，表示本节是0x400字节长）。
//FileAlignment 文件中节对齐的粒度。例如，如果该值是(200h),，那么每节的起始地址必须是512的倍数。
//若第一节从文件偏移量200h开始且大小是10个字节，则下一节必定位于偏移量400h:
//即使偏移量512和1024之间还有很多空间没被使用/定义。
MySectionHeader.SizeOfRawData := (MySectionHeader.VirtualAddress div
PEHEADER.OptionalHeader.FileAlignment + 1) * PEHEADER.OptionalHeader.FileAlignment -
PEHEADER.OptionalHeader.SizeOfImage;
//这是节基于文件的偏移量，PE装载器通过本域值找到节数据在文件中的位置。
MySectionHeader.PointerToRawData :=
SectionHeader.SizeOfRawData + SectionHeader.PointerToRawData;
//包含标记以指示节属性，比如节是否含有可执行代码、初始化数据、未初始数据，是否可写、可读等。
MySectionHeader.Characteristics := $E0000020;
{PE装载器的工作:
1.读取 IMAGE_FILE_HEADER 的 NumberOfSections域，知道文件的节数目。
2.SizeOfHeaders 域值作为节表的文件偏移量，并以此定位节表。
3.遍历整个结构数组检查各成员值。
4.对于每个结构，我们读取PointerToRawData域值并定位到该文件偏移量。然后再读取SizeOfRawData域值来决定
映射内存的字节数。将VirtualAddress域值加上ImageBase域值等于节起始的虚拟地址。然后就准备把节映射进内存，
并根据Characteristics域值设置属性。
5.遍历整个数组，直至所有节都已处理完毕。
注意我们并没有使用节名: 这其实并不重要。}
//节表数量加一
Inc(PEHEADER.FileHeader.NumberOfSections);
//写入新加入的节表
fs.Write(MySectionHeader, sizeOf(MySectionHeader));
//将指针移到PE header在文件中的偏移量
fs.Seek(DOSHEADER._lfanew, soFromBeginning);
//PE装载器准备运行的PE文件的第一个指令的RVA。若您要改变整个执行的流程，
//可以将该值指定到新的RVA，这样新RVA处的指令首先被执行。
AddressOfEntryPoint := PEHEADER.OptionalHeader.AddressOfEntryPoint;
//将入口地址指定到新加节表的RVA(相对虚拟地址)
PEHEADER.OptionalHeader.AddressOfEntryPoint :=
MySectionHeader.VirtualAddress;
//win32子系统版本。
PEHEADER.OptionalHeader.MajorLinkerVersion := 7;
PEHEADER.OptionalHeader.MinorLinkerVersion := 0;
AddressOfEntryPoint := AddressOfEntryPoint +
PEHEADER.OptionalHeader.ImageBase;
asm //这里说明一下，这是嵌入的汇编代码,寄存器—CPU暂时储存数据的东西，比内存更快，以提高效率
PUSHAD
LEA eax, OEPCODE //将OEPCODE的地址交给寄存器
ADD eax, JMPOFF //添加JMPOFF值给寄存器
MOV edx, AddressOfEntryPoint //转移指令，相当于付值语句，左边给右边
MOV DWORD ptr [eax], edx //同上
POPAD
end;
//更改内存中整个PE映像体的尺寸
PEHEADER.OptionalHeader.SizeOfImage :=
PEHEADER.OptionalHeader.SizeOfImage + MySectionHeader.Misc.VirtualSize;
//写入PEHEADER信息
fs.Write(PEHEADER, sizeof(PEHEADER));
//移动指针到文件尾部
fs.Seek(fs.Size, soFromBeginning);
//写入花指令数据
fs.Write(OEPCODE, MySectionHeader.Misc.VirtualSize);
finally
fs.Free;
end;
end;
procedure TForm1.Button1Click(Sender: TObject);
begin
if OpenDialog1.Execute then
edit1.Text :=OpenDialog1.FileName;
end;
procedure TForm1.obtain;
var
DOSHEADER: IMAGE_DOS_HEADER;
PEHEADER: IMAGE_NT_HEADERS;
fs: TFileStream;
begin
fs := TFileStream.Create(Edit1.Text, fmOpenReadWrite +
fmShareDenyWrite);
try
fs.Seek(0, soFromBeginning);
fs.Read(DOSHEADER, sizeof(DOSHEADER));
fs.Seek(DOSHEADER._lfanew, soFromBeginning);
fs.Read(PEHEADER, sizeOf(PEHEADER));
FImageBase := PEHEADER.OptionalHeader.ImageBase;
finally
fs.Free;
end;
end;
procedure TForm1.Button2Click(Sender: TObject);
var
FName,SecName:string;
SecSize:DWord;
begin
if trim(Edit1.Text) = '' then
begin
Messagebox(Handle, '请选择你要伪装的程序!', '提示', MB_OK + MB_ICONSTOP);
Exit;
end;
FName :=trim(Edit1.Text);
SecName :=trim(Edit2.Text);
if SecName='' then SecName:='.hnxyy';
SecSize :=512;
if trim(edit3.Text)<>'' then
begin
SecSize :=strtoint(trim(Edit3.Text));
if SecSize<512 then SecSize :=512;
end;
if CheckBox1.Checked then
CopyFile(PChar(FName),PChar(Fname+'.bak'),False);
SetOepCode;
AddSection(FName,SecName,SecSize);
Messagebox(Handle, '伪装成功!', '提示', MB_OK + MB_ICONINFORMATION);
end;
procedure TForm1.SetOepCode;
begin
OEPCODE :=OEPCODEARRAY[RadioGroup1.ItemIndex];
JMPOFF :=JMPOFFARRAY[RadioGroup1.ItemIndex];
end;
procedure TForm1.Label4Click(Sender: TObject);
begin
ShellExecute(Handle, 'open','http://forum.wrsky.com', '', '', SW_SHOWNORMAL);
end;
procedure TForm1.Edit3KeyPress(Sender: TObject; var Key: Char);
begin
if not (key in ['0'..'9',#8,#13]) then
begin
key :=#0;
end;
end;
end.
delphi版本修改PE头源码的更多相关文章
- MySQL多版本并发控制机制(MVCC)-源码浅析
MySQL多版本并发控制机制(MVCC)-源码浅析 前言 作为一个数据库爱好者,自己动手写过简单的SQL解析器以及存储引擎,但感觉还是不够过瘾.<<事务处理-概念与技术>>诚然 ...
- Android Studio2.x版本无法自动关联源码的解决方法
Android Studio2.x版本无法自动关联源码的解决方法 在学习android开发过程中,对于一个不熟悉的类,阅读源码是一个很好的学习方式,使用andorid studio开发工具的SDK M ...
- python3-开发进阶 django-rest framework 中的 版本操作（看源码解说）
今天我们来说一说rest framework 中的 版本 操作的详解 首先我们先回顾一下 rest framework的流程: 请求进来走view ,然后view调用视图的dispath函数 为了演示 ...
- Lucene全文搜索之分词器：使用IK Analyzer中文分词器（修改IK Analyzer源码使其支持lucene5.5.x）
注意:基于lucene5.5.x版本 一.简单介绍下IK Analyzer IK Analyzer是linliangyi2007的作品,再此表示感谢,他的博客地址:http://linliangyi2 ...
- 修改CKplayer.js 源码解决移动端浏览器全屏不能限制快进的问题
原文地址:https://www.cnblogs.com/jying/p/9642445.html,转载请说明出处. 最近项目需要播放视频且限制未观看部分的快进功能,找了两款js插件ckplayer和 ...
- android studio应用修改到android源码中作为内置应用
1. 方法一:导入,编译(太麻烦,各种不兼容问题) android studio和eclipse的应用结构目录是不同的,但是在android源码中的应用基本上都是使用的eclipse目录结构(在/pa ...
- Hadoop 修改源码以及将修改后的源码应用到部署好的Hadoop中
我的Hadoop版本是hadoop-2.7.3, 我们可以去hadoop官网下载源码hadoop-2.7.3-src,以及编译好的工程文件hadoop-2.7.3, 后者可以直接部署. 前者hadoo ...
- ubuntu 查看软件包版本以及软件包的源码
aptitude show xxx sudo apt-cache show autoconf setattr, getattr, setattr http://ju.outofmemory.cn/e ...
- JS/Jquery版本的俄罗斯方块(附源码分析)
转载于http://blog.csdn.net/unionline/article/details/63250597 且后续更新于此 1.前言 写这个jQuery版本的小游戏的缘由在于我想通过从零到有 ...
随机推荐
- [HNOI2007]梦幻岛宝珠 「套路：分层 $DP$」
显然直接 \(01\) 背包会超时并且超空间 套路:分层 \(DP\) 「考虑将每个子结构看作一层(也就是包含了不止 \(1\) 个物品的信息),并且大层不会对小层造成影响,可以考虑先进行每一层的自我 ...
- MVC母板页传递数据
问题:判断Session 失败 结果: if (Session[SessionKey.AccountInfo] != null) { ViewData["AdminUser"] = ...
- 图学ES6-6.数值的扩展
- MapReduce实战1
MapReduce编程规范: (1)用户编写的程序分成三个部分:Mapper,Reducer,Driver(提交运行mr程序的客户端) (2)Mapper的输入数据是KV对的形式(KV的类型可自定义) ...
- Python学习笔记之爬取网页保存到本地文件
爬虫的操作步骤: 爬虫三步走 爬虫第一步:使用requests获得数据: (request库需要提前安装,通过pip方式,参考之前的博文) 1.导入requests 2.使用requests.get ...
- DSP 程序的执行时间
在访问TSCL寄存器前要定义 cregister volatile unsigned int TSCL; TSCL/TSCH,它们与CPU同频,共同表示一个64-bit数,CPU运行一个cycle,该 ...
- poj-2421-最小生成树刷题
title: poj-2421-最小生成树刷题 date: 2018-11-20 20:30:29 tags: acm 刷题 categories: ACM-最小生成树 概述 做了几道最小生成树的题, ...
- Python 项目实践二（生成数据）第二篇
接着上节继续学习,在本节中,我们将使用Python来生成随机漫步数据,再使用matplotlib以引人瞩目的方式将这些数据呈现出来.随机漫步是这样行走得到的路径:每次行走都完全是随机的,没有明确的方向 ...
- Cdq分治整体二分学习记录
这点东西前前后后拖了好几个星期才学会……还是自己太菜啊. Cdq分治的思想是:把问题序列分割成左右两个,先单独处理左边,再处理左边对右边的影响,再单独处理右边.这样可以消去数据结构上的一个log,降低 ...
- Codeforces Round #397 by Kaspersky Lab and Barcelona Bootcamp (Div. 1 + Div. 2 combined) B. Code obfuscation 水题
B. Code obfuscation 题目连接: http://codeforces.com/contest/765/problem/B Description Kostya likes Codef ...