拉伸pe到内存空间运行

// RunPE.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <windows.h>
#include <stdlib.h>

void RunPE(char* filePath)
{
    HANDLE hFile = NULL;
    HANDLE hFileMap = NULL;
    LPVOID fileAddr = NULL;
    PIMAGE_DOS_HEADER pDosHeader = NULL;
    PIMAGE_NT_HEADERS pNtHeader = NULL;
    DWORD dwSizeOfImage = 0;
    DWORD dwSizeOfHeaders = 0;
    void* imageAddr = NULL;
    PIMAGE_SECTION_HEADER pFirstSectionHeader = NULL;
    
    hFile = CreateFile(filePath,GENERIC_ALL,FILE_SHARE_READ,0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
    if (hFile == INVALID_HANDLE_VALUE)
    {
        printf("打开文件失败\n");
        return;
    }
    
    hFileMap = CreateFileMapping(hFile,0,PAGE_READONLY,0,0,0);
    if (hFileMap == NULL)
    {
        printf("创建文件映射失败\n");
        return;
    }
    
    fileAddr = MapViewOfFile(hFileMap,FILE_MAP_READ,0,0,0);
    if (fileAddr == NULL)
    {
        printf("映射失败\n");
        return;
    }
    
    pDosHeader = (PIMAGE_DOS_HEADER)fileAddr; 
    //判断是否是pe文件
    if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
    {
        printf("错误的pe文件\n");
        return;
    }
    
    pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)fileAddr + pDosHeader->e_lfanew);
    if (pNtHeader->Signature != IMAGE_NT_SIGNATURE)
    {
        printf("IMAGE_NT_SIGNATURE错误\n");
        return;
    }
    //分配pe文件内存空间
    dwSizeOfImage = pNtHeader->OptionalHeader.SizeOfImage;
    imageAddr = (void*)VirtualAlloc(NULL,dwSizeOfImage,MEM_COMMIT | MEM_RESERVE,PAGE_EXECUTE_READWRITE);
    if (imageAddr == NULL)
    {
        printf("空间分配失败\n");
        return;
    }
    //初始化为0
    memset(imageAddr,0,dwSizeOfImage);
    
    //拷贝pe头到内存空间
    dwSizeOfHeaders = pNtHeader->OptionalHeader.SizeOfHeaders;
    memcpy(imageAddr,fileAddr,dwSizeOfHeaders);
    
    //拷贝节到内存中
    pFirstSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)fileAddr + pDosHeader->e_lfanew + sizeof(IMAGE_NT_HEADERS));
    for (int i=0;i<pNtHeader->FileHeader.NumberOfSections;i++)
    {
        //  printf("%s \n",pFirstSectionHeader[i].Name);    
        void* dwRva = (void*)((DWORD)imageAddr + pFirstSectionHeader[i].VirtualAddress);
        void* dwFoa = (void*)((DWORD)fileAddr + pFirstSectionHeader[i].PointerToRawData);
        memcpy(dwRva,dwFoa,pFirstSectionHeader[i].SizeOfRawData);
    }
    
    //修复重定位表
    PIMAGE_DOS_HEADER pMemDosHeader = (PIMAGE_DOS_HEADER)imageAddr;
    PIMAGE_NT_HEADERS pMemNtHeader = (PIMAGE_NT_HEADERS)((DWORD)imageAddr + pMemDosHeader->e_lfanew);
    PIMAGE_BASE_RELOCATION pRelocation =  (PIMAGE_BASE_RELOCATION)((DWORD)imageAddr + pMemNtHeader->OptionalHeader.DataDirectory[5].VirtualAddress);
    if ((void*)pRelocation != imageAddr)
    {
        LONG dwDifference = (DWORD)pMemDosHeader - pMemNtHeader->OptionalHeader.ImageBase;
        while (pRelocation->SizeOfBlock && pRelocation->VirtualAddress)
        {
            //重定位项数据开始地址
            WORD* pLocData = (WORD*)((DWORD)pRelocation +  sizeof(PIMAGE_BASE_RELOCATION));
            //数组长度
            int itemLen = (pRelocation->SizeOfBlock - sizeof(PIMAGE_BASE_RELOCATION)) >> 1 ;
            for (int j=0;j<itemLen;j++)
            {
                if ((pLocData[j] >> 12) == IMAGE_REL_BASED_HIGHLOW)
                {
                    //需要修正的地址
                    DWORD* pAddr = (DWORD*)((DWORD)pMemDosHeader + pRelocation->VirtualAddress + (pLocData[j] & 0x0FFF));
                    *pAddr += dwDifference;
                }   
            }
            pRelocation = (PIMAGE_BASE_RELOCATION)((DWORD)pRelocation + pRelocation->SizeOfBlock);  
        }
    }
    
    //
    PIMAGE_IMPORT_DESCRIPTOR pImportTable = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)imageAddr + pMemNtHeader->OptionalHeader.DataDirectory[1].VirtualAddress);
    while (pImportTable->Name)
    {
        //加载模块
        char* name = (char*)imageAddr + pImportTable->Name;
        HMODULE hDll = LoadLibrary(name);
        if (hDll == NULL)
        {
            printf("%s 加载失败\n");
            return;
        }
        
        PDWORD pThunkData =(PDWORD)( (DWORD)imageAddr + pImportTable->OriginalFirstThunk);
        PDWORD pFirstThunkFuncs =(PDWORD)( (DWORD)imageAddr + pImportTable->FirstThunk);
        
        while (*pThunkData)
        {
            FARPROC lpFuncAddr = NULL;
            if ((*pThunkData) & 0x80000000)//序号导出
            {
                lpFuncAddr = GetProcAddress(hDll, (LPCSTR )((*pThunkData) & 0x0000FFFF) );
            }
            else//名字导出
            {
                PIMAGE_IMPORT_BY_NAME pIIDName = (PIMAGE_IMPORT_BY_NAME) ((DWORD)imageAddr +(*pThunkData));
                lpFuncAddr = GetProcAddress(hDll,(LPCSTR)pIIDName->Name);
            }
            if (lpFuncAddr ==NULL)
            {
                printf("GetProcAddress失败\n");
                return;
            }
            else
            {
                *pFirstThunkFuncs = (DWORD)lpFuncAddr;
            }
            pThunkData++;
            pFirstThunkFuncs++;
        }
        pImportTable++;
        FreeLibrary(hDll);
    }
    
    if (fileAddr)
    {
        UnmapViewOfFile(fileAddr);
    }
    
    if (hFileMap)
    {
        CloseHandle(hFileMap);
    }
    
    if (hFile)
    {
        CloseHandle(hFile);
    }

    pMemNtHeader->OptionalHeader.ImageBase = (DWORD)imageAddr;
    DWORD exeEntry = (DWORD)imageAddr + pMemNtHeader->OptionalHeader.AddressOfEntryPoint;
    __asm
    {
        mov eax,exeEntry
        jmp eax
    }
    
/*  
    if (imageAddr != NULL)
    {
        VirtualFree(imageAddr,0,MEM_RELEASE);
    }
*/
    
          
}

int main(int argc, char* argv[])
{
    char filePath[200] = "c:/win32.exe";
    RunPE(filePath);
    printf("Hello World!\n");
    return 0;
}