modify.asm

PE信息修改。 只作了一项

	.386
	.model flat,stdcall
	  option casemap:none
	  include windows.inc
	  include kernel32.inc
	 include user32.inc
	 includelib user32.lib
	  includelib kernel32.lib
	
	  
	.data
	FileFilter db "*.exe",0
	FindData   WIN32_FIND_DATA <>
	PE_head    IMAGE_NT_HEADERS    <0> 
	CurPath db 256 dup(0)
	hFile dd 0
	hFind dd 0
	PE_head_addr dd 0
	byte_read  dd 0
	Link dw 0707h
	Msg db "Well done",0
	
	.code
	start:
	
		invoke GetCurrentDirectory,256,offset CurPath
		invoke FindFirstFile,offset FileFilter,offset FindData
		cmp eax,INVALID_HANDLE_VALUE
		jz FindEnds
		mov hFind,eax
	GoOnFind: 
		invoke CreateFile,offset FindData.cFileName,GENERIC_READ+GENERIC_WRITE,FILE_SHARE_READ+FILE_SHARE_WRITE,0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0
		cmp eax,INVALID_HANDLE_VALUE
		jz createfail
		mov hFile,eax
		invoke SetFilePointer,hFile,3ch,0,FILE_BEGIN
	    invoke ReadFile,hFile,offset PE_head_addr,4,offset byte_read,0             ;从3ch读PE头地址
	    cmp eax,0
		jz readfail
		invoke SetFilePointer,hFile,PE_head_addr,0,FILE_BEGIN                      ;指针移到PE头
		invoke ReadFile,hFile,offset PE_head,sizeof PE_head,offset byte_read,0      ;读出PE头
		
	    cmp dword ptr PE_head.Signature,IMAGE_NT_SIGNATURE
		jnz exitwrite
		cmp word ptr PE_head[1ah],0707h            
		jz exitwrite
		mov eax,dword ptr PE_head_addr
		add eax,1ah
		invoke SetFilePointer,hFile,eax,0,FILE_BEGIN
		invoke WriteFile,hFile,offset Link,2,offset byte_read,0
	exitwrite:
	readfail:
		 invoke CloseHandle,hFile
	createfail:
		
		invoke FindNextFile,hFind,offset FindData
		test eax,eax
	    jnz GoOnFind 
			  
		FindEnds:
		invoke FindClose,hFile
		invoke MessageBox,NULL,offset Msg,offset Msg,64
		invoke ExitProcess,0

    end	start