Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   IDA script to rebuild relocation table in dumped image of PE file protected by packer (https://forum.exetools.com/showthread.php?t=21708)

Carina0206 07-30-2026 01:07

IDA script to rebuild relocation table in dumped image of PE file protected by packer
 
In general, packer/protector tools delete relocation table information in packed pe image or make it to be broken.
In making dumped pe image to be runnable, rebuilding of broken relocation table also is one of important problems.
Even though someone recovers fully runnable codes from dumped image, if relocation table wouldn't be recovered, normal execution of it can't be sure because it can be only loaded on the base address of when it was dumped.
Thus, he has to set relocation stripped flag in pe header of that executable, and this occurs base address confliction problem between another executable files needed to execution.
So here introduces simple IDA script that i made and used in much those cases.
This doesn't need execution of dumped image file, and it can be completed in statically on IDA.

Code:

auto orig_begin, orig_end, image_begin, image_end, image_base;
auto i, j, temp, curr_inst, curr_table_pos;
auto reloc_table, size_offset, reloc_base;
auto is_first, reloc_value;
image_base = 0x180000000;      // dumped full image's base address
orig_begin = 0x180001000;      // starting address of first section of original pe image
orig_end = 0x1800FF000;        // ending address of original pe image (except for packer's sections)
image_begin = 0x180000000;    // starting address of dumped full image
image_end = 0x1806E4FFF;      // ending address of dumped full image
reloc_table = 0x1806E5000;    // address to place relocation table newly
curr_table_pos = reloc_table;
for(j = orig_begin; j < orig_end; j = j + 0x1000)
{
  i = 0;
  is_first = 0;
  reloc_base = j - image_base;
  while(i < 0x1000)
  {
    temp = get_qword(j + i);
    if(temp >= image_begin && temp <= image_end)
    {
      if(is_first == 0)
      {
        patch_dword(curr_table_pos, reloc_base);
        curr_table_pos = curr_table_pos + 4;
        size_offset = curr_table_pos;
        curr_table_pos = curr_table_pos + 4;
        is_first = 1;
      }
      reloc_value = 0xA000 + i;
      patch_word(curr_table_pos, reloc_value);
      curr_table_pos = curr_table_pos + 2;
      jumpto(j + i);
      curr_inst = get_curline();
      msg("%x  :  %s\n", j + i, curr_inst);
      i = i + 8;
    }
    else
    {
      i = i + 1;
    }
  }
  if(is_first == 1)
  {
    patch_word(curr_table_pos, 0x0);
    curr_table_pos = curr_table_pos + 2;
    patch_dword(size_offset, curr_table_pos - size_offset + 4);
  }
}



All times are GMT +8. The time now is 06:15.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX