PE结构解析的代码

Posted 2021-03-03 go2sleep

0x00 32位程序的PE结构

DOS头

typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
    WORD   e_magic;                     // Magic number
    WORD   e_cblp;                      // Bytes on last page of file
    WORD   e_cp;                        // Pages in file
    WORD   e_crlc;                      // Relocations
    WORD   e_cparhdr;                   // Size of header in paragraphs
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
    WORD   e_ss;                        // Initial (relative) SS value
    WORD   e_sp;                        // Initial SP value
    WORD   e_csum;                      // Checksum
    WORD   e_ip;                        // Initial IP value
    WORD   e_cs;                        // Initial (relative) CS value
    WORD   e_lfarlc;                    // File address of relocation table
    WORD   e_ovno;                      // Overlay number
    WORD   e_res[4];                    // Reserved words
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
    WORD   e_res2[10];                  // Reserved words
    LONG   e_lfanew;                    // File address of new exe header
  } IMAGE_DOS_HEADER;

nt头 = PE标识 + 文件头 ＋ 扩展头

typedef struct _IMAGE_NT_HEADERS {
    DWORD Signature;
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
} IMAGE_NT_HEADERS32,

文件头

typedef struct _IMAGE_FILE_HEADER {
    WORD    Machine;
    WORD    NumberOfSections;
    DWORD   TimeDateStamp;
    DWORD   PointerToSymbolTable;
    DWORD   NumberOfSymbols;
    WORD    SizeOfOptionalHeader;
    WORD    Characteristics;
} IMAGE_FILE_HEADER;

扩展头，文件头中的SizeOfOptionalHeader指定了扩展头的大小。

typedef struct _IMAGE_OPTIONAL_HEADER {
    //
    // Standard fields.
    //

    WORD    Magic;
    BYTE    MajorLinkerVersion;
    BYTE    MinorLinkerVersion;
    DWORD   SizeOfCode;
    DWORD   SizeOfInitializedData;
    DWORD   SizeOfUninitializedData;
    DWORD   AddressOfEntryPoint;
    DWORD   BaseOfCode;
    DWORD   BaseOfData;

    //
    // NT additional fields.
    //

    DWORD   ImageBase;
    DWORD   SectionAlignment;
    DWORD   FileAlignment;
    WORD    MajorOperatingSystemVersion;
    WORD    MinorOperatingSystemVersion;
    WORD    MajorImageVersion;
    WORD    MinorImageVersion;
    WORD    MajorSubsystemVersion;
    WORD    MinorSubsystemVersion;
    DWORD   Win32VersionValue;
    DWORD   SizeOfImage;
    DWORD   SizeOfHeaders;
    DWORD   CheckSum;
    WORD    Subsystem;
    WORD    DllCharacteristics;
    DWORD   SizeOfStackReserve;
    DWORD   SizeOfStackCommit;
    DWORD   SizeOfHeapReserve;
    DWORD   SizeOfHeapCommit;
    DWORD   LoaderFlags;
    DWORD   NumberOfRvaAndSizes;
    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER32;

0x01 一份用c实现的代码段起始地址获取

• 读取dos头，获得nt头的偏移A
• 文件头的偏移为A+sizeof(DWORD)

int get_text(FILE *file, unsigned int *start, unsigned int *end, unsigned int *vaddr)
{
	/*目标文件为32位*/
	/*获取代码段在二进制文件中的起始和终止地址*/

	FILE *pfile = file;
	unsigned int e_lfanew;
	unsigned int optional_header_size;
	unsigned int section_count;

	IMAGE_DOS_HEADER *dos_header;
	IMAGE_FILE_HEADER *file_header;
	IMAGE_SECTION_HEADER *section_header;

	/*读取dos头*/
	dos_header = (IMAGE_DOS_HEADER *)calloc(1, sizeof(IMAGE_DOS_HEADER));
	fread(dos_header, sizeof(IMAGE_DOS_HEADER), 1, file);
	e_lfanew = dos_header->e_lfanew;
	free(dos_header);

	/*读取文件头*/
	file_header = (IMAGE_FILE_HEADER *)calloc(1, sizeof(IMAGE_FILE_HEADER));
	//文件头的偏移为 e_lfanew + sizeof(DWORD)
	fseek(file, e_lfanew + sizeof(DWORD), SEEK_SET);
	fread(file_header, sizeof(IMAGE_FILE_HEADER), 1 , file);
	optional_header_size = file_header->SizeOfOptionalHeader;
	section_count = file_header->NumberOfSections;
	free(file_header);

	/*读取节表*/
	section_header = (IMAGE_SECTION_HEADER *)calloc(section_count, sizeof(IMAGE_SECTION_HEADER));
	//节表的偏移为 e_lfanew + sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER) + optional_header_size
	fseek(file, e_lfanew + sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER) + optional_header_size, SEEK_SET);
	fread(section_header, sizeof(IMAGE_SECTION_HEADER), section_count, file);

	for (int i = 0; i < section_count; i++) {
		if (strncmp((char *)(section_header + i)->Name, ".text", 5) == 0) {
			*start = (section_header + i)->PointerToRawData;
			*end = (section_header + i)->PointerToRawData + (section_header + i)->SizeOfRawData;
			*vaddr = (section_header + i)->VirtualAddress;
			break;
		}
	}

	free(section_header);
	return 0;
}

0x02 去除ASLR

dll加载时启用ALSR是由操作系统和二进制文件两方面决定的，Windows 10中的Windows安全中心提供了关闭ASLR的选项，但是启用后并不奏效，使用一些老的方法（修改注册表内存管理中的MoveImages值为零）也失效了，因此直接把二进制文件中的位进行修改。
这是由扩展头中的DllCharacteristics决定的，IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE这一位是关键，将其置零，那么将DllCharacteristics的值与上0xFFBF即可。

// DllCharacteristics Entries

//      IMAGE_LIBRARY_PROCESS_INIT            0x0001     // Reserved.
//      IMAGE_LIBRARY_PROCESS_TERM            0x0002     // Reserved.
//      IMAGE_LIBRARY_THREAD_INIT             0x0004     // Reserved.
//      IMAGE_LIBRARY_THREAD_TERM             0x0008     // Reserved.
#define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA    0x0020  // Image can handle a high entropy 64-bit virtual address space.
#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040     // DLL can move.
#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY    0x0080     // Code Integrity Image
#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT    0x0100     // Image is NX compatible
#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200     // Image understands isolation and doesn‘t want it
#define IMAGE_DLLCHARACTERISTICS_NO_SEH       0x0400     // Image does not use SEH.  No SE handler may reside in this image
#define IMAGE_DLLCHARACTERISTICS_NO_BIND      0x0800     // Do not bind this image.
#define IMAGE_DLLCHARACTERISTICS_APPCONTAINER 0x1000     // Image should execute in an AppContainer
#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER   0x2000     // Driver uses WDM model
#define IMAGE_DLLCHARACTERISTICS_GUARD_CF     0x4000     // Image supports Control Flow Guard.
#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE     0x8000

一份python脚本

import sys
import pefile
import struct

class Patch(object):
    def __init__(self, filename):
        with open(filename, ‘rb‘) as f:
            self.data = f.read()

    def save_file(self, filename):
        with open(filename, ‘wb‘) as f:
            f.write(self.data)

    def patch_file(self, offset, data):
        if(offset >= 0) and (offset + len(data)) < len(self.data):
            self.data = self.data[0:offset] + data + self.data[offset+len(data):]
            return True
        else:
            return False

def get_dllcharacteristics(pe):
    offset = pe.OPTIONAL_HEADER.get_field_absolute_offset(‘DllCharacteristics‘)
    value = pe.OPTIONAL_HEADER.DllCharacteristics
    return offset, value


def disable_aslr(file):
    pe = pefile.PE(file)
    offset, value = get_dllcharacteristics(pe)
    # IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = 0
    value &= 0xFFBF

    patch = Patch(file)
    if patch.patch_file(offset, struct.pack(‘<H‘, value)):
        patch.save_file(file + ‘_patch‘)

if __name__ == ‘__main__‘:
    disable_aslr(sys.argv[1])