Windows 逆向与 C/C++ 安全开发：从漏洞原理到防御编码

import struct
from pathlib import Path

def parse_pe_headers(path: Path) -> dict:
    data = path.read_bytes()
    if data[:2] != b"MZ":
        raise ValueError("不是有效的 PE 文件")

    e_lfanew = struct.unpack_from("<I", data, 0x3C)[0]
    if data[e_lfanew:e_lfanew + 4] != b"PE\x00\x00":
        raise ValueError("PE 签名无效")

    coff_off = e_lfanew + 4
    machine, num_sections = struct.unpack_from("<HH", data, coff_off)
    opt_size = struct.unpack_from("<H", data, coff_off + 16)[0]

    opt_off = coff_off + 20
    magic = struct.unpack_from("<H", data, opt_off)[0]
    entry = struct.unpack_from("<I", data, opt_off + 16)[0]
    image_base = struct.unpack_from("<Q", data, opt_off + 24)[0] \
        if magic == 0x20B else struct.unpack_from("<I", data, opt_off + 28)[0]

    sections = []
    sec_off = opt_off + opt_size
    for i in range(num_sections):
        off = sec_off + i * 40
        name = data[off:off + 8].rstrip(b"\x00").decode(errors="ignore")
        vsize, vaddr, rsize, raddr = struct.unpack_from("<IIII", data, off + 8)
        chars = struct.unpack_from("<I", data, off + 36)[0]
        sections.append({
            "name": name, "vaddr": hex(vaddr),
            "vsize": vsize, "raw_size": rsize,
            "executable": bool(chars & 0x20000000),
            "writable": bool(chars & 0x80000000),
        })

    return {
        "machine": hex(machine),
        "entry_point": hex(entry),
        "image_base": hex(image_base),
        "sections": sections,
    }

// 危险：不检查长度
void unsafe_copy(const char *input) {
    char buf[64];
    strcpy(buf, input);  // 输入超长则覆盖返回地址
}

// 安全：显式限制长度
#include <string.h>
int safe_copy(const char *input) {
    char buf[64];
    if (strlen(input) >= sizeof(buf)) {
        return -1;  // 拒绝超长输入
    }
    memcpy(buf, input, strlen(input) + 1);
    return 0;
}

// 危险：size 可能溢出
void *bad_alloc(unsigned int count, unsigned int size) {
    return malloc(count * size);
}

// 安全：检查乘法溢出
#include <stdint.h>
void *safe_alloc(size_t count, size_t size) {
    if (size != 0 && count > SIZE_MAX / size) {
        return NULL;
    }
    return malloc(count * size);
}

// 危险：指针悬空
void bad_use() {
    int *p = new int(42);
    delete p;
    *p = 10;  // UAF
}

// 安全：使用智能指针
#include <memory>
void safe_use() {
    auto p = std::make_unique<int>(42);
    *p = 10;
    // 离开作用域自动释放
}