合并节： 1、拉伸到内存 2、将第一个节的内存大小、文件大小改成一样 Max = SizeOfRawData>VirtualSize?SizeOfRawData:VirtualSize SizeOfRawData = VirtualSize = 最后一个节的VirtualAddress + Max - SizeOfHeaders内存对齐后的大小 3、将第一个节的属性改为包含所有节的属性 （重点） 4、修改节的数量为1
BOOL MergingSection(IN OUT LPVOID* pImageBuffer) { //DOC头 PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)*pImageBuffer; //NT头 PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew); //标准PE头 PIMAGE_FILE_HEADER pPEHeader = (PIMAGE_FILE_HEADER)(((DWORD)pNTHeader) + 4); //可选PE头 PIMAGE_OPTIONAL_HEADER32 pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + IMAGE_SIZEOF_FILE_HEADER); if (*((PWORD)*pImageBuffer) != IMAGE_DOS_SIGNATURE) { printf("MZ文件标志头不存在！"); free(pImageBuffer); return false; } PIMAGE_SECTION_HEADER pSectionHeader = NULL; pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader + pPEHeader->SizeOfOptionalHeader); DWORD Max = pSectionHeader->SizeOfRawData > pSectionHeader->Misc.VirtualSize ? pSectionHeader->SizeOfRawData : pSectionHeader->Misc.VirtualSize; PIMAGE_SECTION_HEADER pSectionHeader_tmp = pSectionHeader; pSectionHeader_tmp += (pPEHeader->NumberOfSections - 1); pSectionHeader->SizeOfRawData = pSectionHeader->Misc.VirtualSize = Align(pSectionHeader_tmp->VirtualAddress + Max - pOptionHeader->SizeOfHeaders, pOptionHeader->SectionAlignment); pPEHeader->NumberOfSections = 1; return true; }Github地址：https://github.com/vShellCode/Analysis-of-PE-structure
