#1
|
|||
|
|||
Relocations Directory
Hello, I'm coding a simple packer, I want it to pack also DLL files, so I tryed to find anything about relocations directory' structure, but nothing was found (I've tryed forum's search engine too, two pages result on "relocations", but nothing about structure..). I researched it manually - comparing its' hex values with LordPE values, ok it has very simple structure and it will be very easy to do what I want, but I still can't understand the meaning of one 1-byte item (EDIT: plz see the note in the end) of the structure, LordPE identifies it as "Type". In all dll-s that i've looked this value was 3 (LordPE show HIGHLOW(3)). but just for interest i tryed to change these values (each address that must be relocated has this item) to other all available values (0 - F) and here is how LordPE idendifies their types:
0 - ABSOLUTE(0) 1 - HIGH(1) 2 - LOW(2) 3 - HIGHLOW(3) <- this one is used in all PE's i've seen 4 - HIGHADJ(4) 5 - MIPS_JMPADDR(5) 6 - SECTION(6) 7 - REL(7) 8 - ?? 9 - IA64_IMM64(9) A - DIR64(10) B - HIGH3ADJ(11) C - ?? D - ?? E - ?? F - ?? So, a question - what it is for? And, are there any differences when relocating the addresses "manually" (not by System's PE Loader) if this value is not 3 (HIGHLOW(3)) ? Thanks. EDIT: ahh, of course it isn't 1 byte value, it's 4-bit value ok, there is a WORD, like this 34AB, it means type 3 (HIGHLOW(3)), and the address which needs to be relocated is BaseAddress + 04AB (BaseAddress is also in the structure, must be alligned to 1000h). Example 2: 4ADD - type - HIGHADJ(4), relative address - 0ADD. brr.. Last edited by arnix; 06-03-2005 at 18:52. |
#2
|
|||
|
|||
Code:
unsigned long delta = (current_base - image_base); unsigned int fixup = *(unsigned short*)(table); table += 2; unsigned int type = (fixup >> 12) & 0x0f; unsigned int offs = (fixup & 0xfff); switch( type ) { case 0: /* IMAGE_REL_BASED_ABSOLUTE */ break; /* ignore */ case 1: /* IMAGE_REL_BASED_HIGH */ *(unsigned short*)(block_rva + offs) += (delta >> 16) & 0xffff; break; case 2: /* IMAGE_REL_BASED_LOW */ *(unsigned short*)(block_rva + offs) += (delta & 0xffff); break; case 3: /* IMAGE_REL_BASED_ABSOLUTE */ *(unsigned long*)(block_rva + offs) += delta; break; default: say_error("WTF? Int's not Win32 PE fixupt type"); exit(-1); } |
#3
|
|||
|
|||
Hello,
take a look at a file named PEcoff.pdf, this is the PE/COFF specification from M$. Everything you need is explained in chapter 6.6 (the .reloc section). BTW the 6,7 and 8th field are'nt documented... and there's no fields above 11 (0xB). Here's a link, you'll not have to search for it : http://neitsabes.online.fr/docs/pecoff.pdf |
#4
|
|||
|
|||
Dr.Golova, Neitsa
Thank you guys Quote:
|
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
How to patch a dll with relocations? | aijundi | General Discussion | 2 | 10-13-2022 03:08 |
Armadillo DLL Relocations.. | xzz | General Discussion | 4 | 09-28-2004 02:17 |
pecompact, dll, relocations | ftw | General Discussion | 2 | 07-25-2004 07:49 |