View Single Post
Old 02-15-2022, 04:13
RamMerLabs RamMerLabs is online now
Join Date: Feb 2020
Posts: 39
Rept. Given: 0
Rept. Rcvd 39 Times in 17 Posts
Thanks Given: 9
Thanks Rcvd at 184 Times in 33 Posts
RamMerLabs Reputation: 39
Well, actually there are two kinds of CHPE2 (perhaps it would be better to say "CHPE64"): ARM64EC and ARM64X.

The first of them, as you already said, is only for emulation under a different platform, it speaks for itself: EC - Emulation Compatible. The second - ARM64X - a pure chameleon and contains code for both ARM64 and x64 execution at the same time, and is used in various system components (examples can be found in system32 from Windows for arm64).
You can create the first one yourself in recent Visual Studio, for the second one I have not met a public toolset yet.

How can the same ARM64X PE be for different architectures? The point is a new type of DVRT entries (Dynamic Value Relocation Table, which can be found in IMAGE_LOAD_CONFIG_DIRECTORY): IMAGE_DYNAMIC_RELOCATION_ARM64X.
Following the specified settings, the loader simply patches the mapped image for x64, namely: headers, RVAs of import directory, export directory, exceptions data table, etc. Resulting as if it were a real x64 image. And now... the patched image becomes ARM64EC

By the way, almost everything described above can be demonstrated by my program PEAnatomist
Reply With Quote
The Following User Says Thank You to RamMerLabs For This Useful Post:
DavidXanatos (02-15-2022)