![]() |
IDA script to rebuild relocation table in dumped image of PE file protected by packer
In general, packer/protector tools delete relocation table information in packed pe image or make it to be broken.
In making dumped pe image to be runnable, rebuilding of broken relocation table also is one of important problems. Even though someone recovers fully runnable codes from dumped image, if relocation table wouldn't be recovered, normal execution of it can't be sure because it can be only loaded on the base address of when it was dumped. Thus, he has to set relocation stripped flag in pe header of that executable, and this occurs base address confliction problem between another executable files needed to execution. So here introduces simple IDA script that i made and used in much those cases. This doesn't need execution of dumped image file, and it can be completed in statically on IDA. Code:
auto orig_begin, orig_end, image_begin, image_end, image_base; |
| All times are GMT +8. The time now is 06:15. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX