PE 将notepad存入内存后 文件大小变小问题

braindamage

#define _CRT_SECURE_NO_WARNINGS
#include<stdio.h>
#include<stdlib.h>
#include<Windows.h>
#include<string.h>
//代码在虚拟机可以用 这台win7  读出文件大小和真实大小不一样  OK
//是不是32位的原因呢？
int file(PVOID* fp1)
{
        FILE* fp = NULL;
        fp = fopen("C:\\Windows\\System32\\notepad.exe", "rb");
        if (!fp)
        {
                printf("fopen error");
                return 0;
        }
        fseek(fp, 0, SEEK_END);
        int fsize = ftell(fp);
        printf("filesize is %d\n",fsize);
        rewind(fp);
       
        *fp1 = fp;
        fp = NULL;
        //fclose(fp);  buxing
        return fsize;

}

int filebuffer(int size, FILE* fp, PVOID* pTempFileBuffer)
{
        if (!fp)
        {
                printf("open error");
                return 0;
        }
        PVOID temp = malloc(size);
        if (!temp)
        {
                printf("malloc error");
                return 0;
        }
        fread(temp, 1, size, fp);
        PIMAGE_DOS_HEADER pdos = (PIMAGE_DOS_HEADER)temp;
        printf("magic is %x\nlfanew is %x \n", pdos->e_magic, pdos->e_lfanew);
       
       
       
        *pTempFileBuffer = temp;
        temp = NULL;
        return 0;


}

int movFilBuffer2ImageBuffer(PVOID* pTempImageBuffer, PVOID pTempFileBuffer)
{
        PIMAGE_DOS_HEADER pdos = (PIMAGE_DOS_HEADER)pTempFileBuffer;
        PIMAGE_NT_HEADERS32 pnt = (PIMAGE_NT_HEADERS32)((DWORD)pdos + pdos->e_lfanew);
        if (pnt->Signature != IMAGE_NT_SIGNATURE)
        {
                printf("signature error");
                return 0;
        }
        PIMAGE_FILE_HEADER pfile = (PIMAGE_FILE_HEADER)((DWORD)pnt + 4);
        PIMAGE_OPTIONAL_HEADER32 pop = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pfile + 0x14);
        PIMAGE_SECTION_HEADER psec = (PIMAGE_SECTION_HEADER)((DWORD)pop + pfile->SizeOfOptionalHeader);
        printf("op magic is %x\n", pop->Magic);
        printf("name is %s\n", psec->Name);

        PVOID temp = malloc(pop->SizeOfImage);
        if (!temp)
        {
                printf("malloc error");
                return 0;
        }
        memset(temp, 0, pop->SizeOfImage);
        memcpy(temp, pTempFileBuffer, pop->SizeOfHeaders);
        for (int i = 0;i < pfile->NumberOfSections;i++, psec++)
        {
                memcpy((PVOID)((DWORD)temp + psec->VirtualAddress), (PVOID)((DWORD)pTempFileBuffer + psec->PointerToRawData), psec->SizeOfRawData);


        }

       
        *pTempImageBuffer = temp;
        temp = NULL;
        return pop->SizeOfImage;











        return 0;
       
}


int movImageBuffer2NewfileBuffer(int size,PVOID* pNewFileBuffer, PVOID pTempImageBuffer)
{
        PVOID temp = malloc(size);
        if (!temp)
        {
                printf("malloc error");
                return 0;
        }
       
        PIMAGE_DOS_HEADER pdos = (PIMAGE_DOS_HEADER)pTempImageBuffer;
        PIMAGE_NT_HEADERS32 pnt = (PIMAGE_NT_HEADERS32)((DWORD)pdos + pdos->e_lfanew);
        if (pnt->Signature != IMAGE_NT_SIGNATURE)
        {
                printf("signature error");
                return 0;
        }
        PIMAGE_FILE_HEADER pfile = (PIMAGE_FILE_HEADER)((DWORD)pnt + 4);
        PIMAGE_OPTIONAL_HEADER32 pop = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pfile + 0x14);
        PIMAGE_SECTION_HEADER psec = (PIMAGE_SECTION_HEADER)((DWORD)pop + pfile->SizeOfOptionalHeader);
        memset(temp, 0, size);
        memcpy(temp, pTempImageBuffer, pop->SizeOfHeaders);
        int newsize = (int)pop->SizeOfHeaders;
        for (int i = 0;i < pfile->NumberOfSections;i++,psec++)
        {
                memcpy((PVOID)((DWORD)temp + (DWORD)psec->PointerToRawData), (PVOID)((DWORD)pTempImageBuffer + (DWORD)psec->VirtualAddress), psec->SizeOfRawData);
                newsize += psec->SizeOfRawData;
        }

        *pNewFileBuffer = temp;
        temp = NULL;

        return newsize;
}

int writefile(int newsize,PVOID pNewFileBuffer)
{
        FILE* fp2 =        fopen("D:\\test\\1.exe", "wb");
        if (!fp2)
        {
                printf("w  open error");
                return 0;
        }
        fwrite(pNewFileBuffer, 1, newsize, fp2);
        fclose(fp2);
        return 1;
}
void fun()
{
        FILE* fp = NULL;
        PVOID pTempFileBuffer = NULL;
        PVOID pTempImageBuffer = NULL;
        PVOID pNewFileBuffer = NULL;
        int filesize = file((PVOID*)(&fp));
        printf("file size is %x\n", filesize);
        int filebuffersize = filebuffer(filesize, fp, &pTempFileBuffer);
        int imagesize = movFilBuffer2ImageBuffer(&pTempImageBuffer, pTempFileBuffer);
        printf("imagesize is %x\n",imagesize);
        int Newsize = movImageBuffer2NewfileBuffer(filesize, &pNewFileBuffer, pTempImageBuffer);
        printf("newsize is %x\n", Newsize);
        int res = writefile(Newsize, pNewFileBuffer);
        printf("res is %d", res);


}
int main()
{
        fun();


        getchar();

}