对PE文件修改的一种解决方案PEPatch

A Solution Named PEPatch About Revision of PE Document

首先分析了PE文件的基本结构,着重说明了PE头及节表结构,然后介绍了如何增加一个节表并修改入口点到这个新加节表中的技术。通过这种技术,程序运行起来时可以执行事先指定的代码,以达到修改或者增加程序功能的目的。此外,本文在理论的基础上给出一个雏形结构,称之为PEPatch,通过这个结构可以在未得到文件源码的情况下,加强这个文件的功能,或者在需要修改文件bug以及其他要求的情况下,也可以顺利实现对这个文件的修改。

This paper analyses the basic structure of PE document, emphasizes the explanation of PE header and section table structure, then introduces a technology on how to add a section table and amend the entry point to the new table. Though this technology, procedures can execute specified code in advance, so as to achieve the purpose of procedure modification and enhancement. In addition, this paper gives a prototype structure which is based on theory, it is named PEPatch, though this structure, it can strengthen the function of this document without its sound code, or in the need to amend the document bug, as well as other requirements of the case, it can amend this document successfully.