cli/q
1
0
Fork 0
Code Issues Pull requests Releases Activity

Implemented loading of multiple DLLs

Browse source
This commit is contained in:
Eduard Urbach 2024-08-17 15:34:42 +02:00
parent 58a157c864
commit 3eba9fb526
Signed by: eduard
GPG key ID: 49226B848C78F6C8
4 changed files with 57 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

87
src/exe/pe/EXE.go
View file

@ -17,80 +17,57 @@ type EXE struct {
Sections []SectionHeader
}
type DLL struct {
Name string
Functions []string
}
// Write writes the EXE file to the given writer.
func Write(writer io.Writer, code []byte, data []byte) {
func Write(writer io.Writer, code []byte, data []byte, dlls []DLL) {
NumSections := 2
HeaderEnd := DOSHeaderSize + NTHeaderSize + OptionalHeader64Size + SectionHeaderSize*NumSections
codeStart, codePadding := exe.Align(HeaderEnd, config.Align)
dataStart, dataPadding := exe.Align(codeStart+len(code), config.Align)
dlls := []DLL{
{
Name: "kernel32.dll",
Functions: []string{
"ExitProcess",
"GetStdHandle",
"WriteFile",
},
},
}
dllAddresses := []uint64{}
dllImports := []DLLImport{}
dllName := len(data)
data = append(data, dlls[0].Name...)
data = append(data, 0x00)
for _, f := range dlls[0].Functions {
pos := len(data)
data = append(data, 0x00, 0x00)
data = append(data, f...)
for _, dll := range dlls {
dllAddresses := []uint64{}
dllNamePos := len(data)
data = append(data, dll.Name...)
data = append(data, 0x00)
if len(data)&1 != 0 {
data = append(data, 0x00) // align the next entry on an even boundary
for _, f := range dll.Functions {
pos := len(data)
data = append(data, 0x00, 0x00)
data = append(data, f...)
data = append(data, 0x00)
if len(data)&1 != 0 {
data = append(data, 0x00) // align the next entry on an even boundary
}
dllAddresses = append(dllAddresses, uint64(dataStart+pos))
}
dllAddresses = append(dllAddresses, uint64(dataStart+pos))
dllAddresses = append(dllAddresses, 0)
// Add the address table to the data section
functionAddressesStart := dataStart + len(data)
data, _ = binary.Append(data, binary.LittleEndian, &dllAddresses)
dllImports = append(dllImports, DLLImport{
RvaFunctionNameList: uint32(functionAddressesStart),
TimeDateStamp: 0,
ForwarderChain: 0,
RvaModuleName: uint32(dataStart + dllNamePos),
RvaFunctionAddressList: uint32(functionAddressesStart),
})
}
dllAddresses = append(dllAddresses, 0)
// Add the address table to the data section
functionAddressesStart := dataStart + len(data)
functionAddressesSize := 8 * len(dllAddresses)
data, err := binary.Append(data, binary.LittleEndian, &dllAddresses)
if err != nil {
panic(err)
}
dllImports = append(dllImports, DLLImport{
RvaFunctionNameList: uint32(functionAddressesStart),
TimeDateStamp: 0,
ForwarderChain: 0,
RvaModuleName: uint32(dataStart + dllName),
RvaFunctionAddressList: uint32(functionAddressesStart),
})
dllImports = append(dllImports, DLLImport{}) // a zeroed structure marks the end of the list
// Add imports to the data section
importsStart := dataStart + len(data)
importsSize := DLLImportSize * len(dllImports)
data, err = binary.Append(data, binary.LittleEndian, &dllImports)
data, _ = binary.Append(data, binary.LittleEndian, &dllImports)
if err != nil {
panic(err)
}
imageSize := functionAddressesStart + functionAddressesSize
imageSize := dataStart + len(data)
imageSize, _ = exe.Align(imageSize, config.Align)
pe := &EXE{
@ -151,7 +128,7 @@ func Write(writer io.Writer, code []byte, data []byte) {
{VirtualAddress: 0, Size: 0},
{VirtualAddress: 0, Size: 0},
{VirtualAddress: 0, Size: 0},
{VirtualAddress: uint32(functionAddressesStart), Size: uint32(functionAddressesSize)}, // RVA of the import address table
{VirtualAddress: 0, Size: 0},
{VirtualAddress: 0, Size: 0},
{VirtualAddress: 0, Size: 0},
{VirtualAddress: 0, Size: 0},