sectionimport.cpp

一个用BCB写的壳！

                            dwFuncNamesRVA++; // NULL padding
                        } else {
                            // Write ordinal
                            dwTemp = (*ii).Type.wOrdinal;
                            dwTemp |= IMAGE_ORDINAL_FLAG;
                            CopyMemory(pCurrent, &dwTemp, sizeof(DWORD));
                            pCurrent += sizeof(DWORD);
                        }
                    }
                }

                // Write NULL pointer
                ZeroMemory(pCurrent, sizeof(DWORD));
                pCurrent += sizeof(DWORD);
            }

            // Write functions
            for (si = m_lstDLLs.begin(); si != m_lstDLLs.end(); si++) {
                for (ii = m_lstImports.begin(); ii != m_lstImports.end(); ii++) {
                    if (((*ii).dll == si) && ((*ii).flIsOrdinal == FALSE)) {
                        // Write hint/function name
                        CopyMemory(pCurrent, &(*ii).wHint, sizeof(WORD));
                        pCurrent += sizeof(WORD);
                        if ((*ii).Type.pName) {
                            CopyMemory(pCurrent, (*ii).Type.pName, lstrlen((*ii).Type.pName) + 1);
                            pCurrent += lstrlen((*ii).Type.pName) + 1;
                        } else {
                            // Write zero
                            *pCurrent = 0;
                            pCurrent++;
                        }
                    }
                }
            }
        }

        hdrSection.SizeOfRawData = dwSize;
        hdrSection.Misc.VirtualSize = dwSize;
        m_pAttached->SetHeader(hdrSection);

        // Update import directory size in NT headers and size of initialized data
        m_ppe->m_Headers.GetNt(hdr);
        hdr.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size = dwUnalignedSize;
        hdr.OptionalHeader.SizeOfInitializedData += dwSize;
        m_ppe->m_Headers.SetNt(hdr);

        // Update size of image
        m_ppe->FixImageSize();

        m_pAttached->SetData(pData, dwSize);
        delete [] pData;

        m_ppe->m_ddImport.Assign(m_ppe->GetDataAtRVA(hdr.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress), dwUnalignedSize);
    }
}

// Get number of functions for a specific DLL
DWORD CSectionImport::GetNumFuncs(strIterator si)
{
    impIterator ii;
    DWORD dwFuncs;

    dwFuncs = 0;

    for (ii = m_lstImports.begin(); ii != m_lstImports.end(); ii++) {
        if ((*ii).dll == si) dwFuncs++;
    }

    return(dwFuncs);
}

// Get total DLL names length
DWORD CSectionImport::GetTotalDLLNamesLength(void)
{
    DWORD dwLength;
    strIterator i;

    dwLength = 0;

    if (m_lstDLLs.empty() == FALSE) {
        for (i = m_lstDLLs.begin(); i != m_lstDLLs.end(); i++) {
            if (*i) {
                dwLength += lstrlen(*i) + 1;
            }
        }
    }

    return(dwLength);
}


// Add an import by name
void CSectionImport::Add(LPSTR pDLLName, LPSTR pFuncName, WORD wHint)
{
    strIterator i;
    IMPORT_ENTRY ie;

    // Zero import entry
    ZeroMemory(&ie, sizeof(IMPORT_ENTRY));

    // Insert DLL to the list
    ie.dll = InsertDLL(pDLLName);
    
    // Set name
    if (pFuncName) {
        ie.Type.pName = new char [lstrlen(pFuncName) + 1];
        if (ie.Type.pName) {
            lstrcpy(ie.Type.pName, pFuncName);
        }
    }
    
    // Set hint
    ie.wHint = wHint;

    m_lstImports.push_back(ie);
}

// Add an import by ordinal
void CSectionImport::Add(LPSTR pDLLName, WORD wOrdinal, WORD wHint)
{
    strIterator i;
    IMPORT_ENTRY ie;

    // Zero import entry
    ZeroMemory(&ie, sizeof(IMPORT_ENTRY));

    // Insert DLL to the list
    ie.dll = InsertDLL(pDLLName);
    
    // Set ordinal
    ie.flIsOrdinal = TRUE;
    ie.Type.wOrdinal = wOrdinal;

    // Set hint
    ie.wHint = wHint;

    m_lstImports.push_back(ie);
}

// Insert a DLL to the list
CSectionImport::strIterator CSectionImport::InsertDLL(LPSTR pDLLName)
{
    strIterator i;
    LPSTR pszName;

    // First make sure the DLL isn't already there
    if (m_lstDLLs.empty() == FALSE) {
        for (i = m_lstDLLs.begin(); i != m_lstDLLs.end(); i++) {
            if (lstrcmpi((*i), pDLLName) == 0) {
                // DLL already exists in list
                return(i);
            }
        }
    }

    // Insert DLL if didn't exist
    pszName = new char [lstrlen(pDLLName) + 1];
    if (pszName) {
        lstrcpy(pszName, pDLLName);
        m_lstDLLs.push_back(pszName);
    }

    return(--m_lstDLLs.end());
}

// Cleanup
void CSectionImport::Cleanup(void)
{
    strIterator si;
    impIterator ii;

    if (m_lstExisting.empty() == FALSE)
        m_lstExisting.clear();

    if (m_lstDLLs.empty() == FALSE) {
        for (si = m_lstDLLs.begin(); si != m_lstDLLs.end(); si++) {
            if (*si)
                delete [] (*si);
        }
        m_lstDLLs.clear();
    }

    if (m_lstImports.empty() == FALSE) {
        for (ii = m_lstImports.begin(); ii != m_lstImports.end(); ii++) {
            if ((*ii).flIsOrdinal == FALSE) {
                if ((*ii).Type.pName) {
                    delete [] (*ii).Type.pName;
                }
            }
        }
        m_lstImports.clear();
    }

    m_ppe = NULL;
    m_pAttached = NULL;
}

// Get export section data
DWORD CSectionImport::GetData(LPBYTE pData) const
{
    DWORD dwSize;

    dwSize = 0;

    if (m_pAttached) {
        return(m_pAttached->GetData(pData));
    }

    return(dwSize);
}

// Get export section header
void CSectionImport::GetHeader(IMAGE_SECTION_HEADER &hdr) const
{
    if (m_pAttached) {
        m_pAttached->GetHeader(hdr);
    }
}

// Check if a file offset is within the section
BOOL CSectionImport::WithinFO(DWORD dwFO) const
{
    if (m_pAttached) {
        return(m_pAttached->WithinFO(dwFO));
    }
    return(FALSE);
}

// Check if a relative virtual address is within the section
BOOL CSectionImport::WithinRVA(DWORD dwRVA) const
{
    if (m_pAttached) {
        return(m_pAttached->WithinRVA(dwRVA));
    }
    return(FALSE);
}

// Set section header
void CSectionImport::SetHeader(IMAGE_SECTION_HEADER &hdrNew)
{
    if (m_pAttached) {
        m_pAttached->SetHeader(hdrNew);
    }
}

}