![]() |
Windows 7 basing problem
I am having a problem with a target I am attempting to reverse. I have added a new section to the file to use to modify some data that is calculated and stored into the program.This code works correctly on XP. However, the feature of random basing that is present in the windows 7 operating system is causing my address references to point to invalid data due to their base not being altered with the rest of the program. Here is my current code:
Code:
01515234 803D 6A525101 0>CMP BYTE PTR DS:[151526A],1 |
you have three options - first is obviously to disable ASLR (clear bit 6 (value 0x40) in the DLL Characteristics field in the PE header); second is to add relocations to the relocation table, so that your addresses will be updated automatically with the rest of the code; third is to use dynamic offsets (call $+5; pop ecx; add ecx, relative offset).
|
Thank you very much, qkumba. You have helped me solve the problem. However, can you recommend a tool that helps a person add new relocations to a exe? Most of the tools I have only allows you to edit existing ones.
|
Sorry, I don't know of any tools to do it. I add mine manually when I need to (which is fortunately not often).
|
without a tool writing position independent code is a lot easier. (and there is no such tool atm).
I´d generally prefer pid-code, easier to write, easier to maintain, no real disadvantages. |
| All times are GMT +8. The time now is 07:06. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX