读书人

批改PE文件自校验值

发布时间: 2012-09-23 10:28:11 作者: rapoo

修改PE文件自校验值

/*
*@修改PE头checksum
*@param1[in]:szFileName:可执行文件完整路径
*@param2[in]:dwCheckSum:新的checksum
*@return:修改成功返回TRUE,否则返回FALSE
*/
BOOL SetExeCheckSum(LPCSTR szFileName,DWORD dwCheckSum)
{
HANDLE hFile = INVALID_HANDLE_VALUE;
HANDLE hMapping = NULL;
LPVOID lpBase = NULL;
BOOL bRet = FALSE;

try
{
hFile = CreateFile(szFileName,GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
if (hFile == INVALID_HANDLE_VALUE)
throw MY_ERROR;

hMapping = CreateFileMapping(hFile,NULL,PAGE_READWRITE,0,0,NULL);
if (hMapping == NULL)
throw MY_ERROR;

lpBase = MapViewOfFile(hMapping,FILE_MAP_ALL_ACCESS,0,0,0);
if (lpBase == NULL)
throw MY_ERROR;

PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)lpBase;
if (IsBadReadPtr(pDosHeader,sizeof(IMAGE_DOS_HEADER)) ||
pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
throw MY_ERROR;

PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew);
if (IsBadReadPtr(pNtHeader,sizeof(IMAGE_NT_HEADERS)) ||
pNtHeader->Signature != IMAGE_NT_SIGNATURE)
throw MY_ERROR;

PIMAGE_OPTIONAL_HEADER pOptHeader = &pNtHeader->OptionalHeader;
if (IsBadReadPtr(pOptHeader,sizeof(IMAGE_OPTIONAL_HEADER)))
throw MY_ERROR;

pOptHeader->CheckSum = dwCheckSum;
bRet = FlushViewOfFile(&pOptHeader->CheckSum,sizeof(DWORD));

throw MY_OK;

}
catch(...)
{
if (lpBase != NULL)
UnmapViewOfFile(lpBase);

if (hMapping != NULL)
CloseHandle(hMapping);

if (hFile != INVALID_HANDLE_VALUE)
CloseHandle(hFile);
}

return bRet;
}

读书人网 >编程

热点推荐