9#define RELOC_32BIT_FIELD 3
10#define RELOC_64BIT_FIELD 0xA
78 printf(
"[-] Not supported relocations format at %d: %d\n", (
int)
i, (
int)
type);
92 std::cout <<
"[-] Failed processing reloc field at: " << std::hex <<
reloc_field <<
"\n";
106 std::cout <<
"[!] WARNING: no relocation table found!\n";
111 std::cerr <<
"[!] Invalid relocDir pointer\n";
125 std::cerr <<
"[-] Invalid address of relocations\n";
129 if (
reloc->SizeOfBlock == 0) {
137 std::cerr <<
"[-] Invalid address of relocations block\n";
160 if (modulePtr ==
NULL) {
167 printf(
"New Base: %llx\n", newBase);
168 printf(
"Old Base: %llx\n", oldBase);
170 if (newBase == oldBase) {
172 printf(
"Nothing to relocate! oldBase is the same as the newBase!\n");
180 printf(
"Could not relocate the module!\n");
virtual bool processRelocField(ULONG_PTR relocField)
ApplyRelocCallback(bool _is64bit, ULONGLONG _oldBase, ULONGLONG _newBase)
bool parse_delayed_desc(BYTE *modulePtr, const size_t moduleSize, const ULONGLONG img_base, LPSTR lib_name, const T_FIELD ordinal_flag, IMAGE_DELAYLOAD_DESCRIPTOR *desc, peconv::t_function_resolver *func_resolver)
ULONGLONG get_image_base(IN const BYTE *pe_buffer)
bool validate_ptr(IN const void *buffer_bgn, IN size_t buffer_size, IN const void *field_bgn, IN size_t field_size)
bool process_relocation_table(IN PVOID modulePtr, IN SIZE_T moduleSize, IN RelocBlockCallback *callback)
bool is64bit(IN const BYTE *pe_buffer)
bool relocate_module(IN BYTE *modulePtr, IN SIZE_T moduleSize, IN ULONGLONG newBase, IN ULONGLONG oldBase=0)
IMAGE_DATA_DIRECTORY * get_directory_entry(IN const BYTE *pe_buffer, IN DWORD dir_id, IN bool allow_empty=false)
bool has_valid_relocation_table(IN const PBYTE modulePtr, IN const size_t moduleSize)
Wrappers over various fields in the PE header. Read, write, parse PE headers.
bool process_reloc_block(BASE_RELOCATION_ENTRY *block, SIZE_T entriesNum, DWORD page, PVOID modulePtr, SIZE_T moduleSize, bool is64bit, RelocBlockCallback *callback)
#define RELOC_64BIT_FIELD
bool apply_relocations(PVOID modulePtr, SIZE_T moduleSize, ULONGLONG newBase, ULONGLONG oldBase)
bool is_empty_reloc_block(BASE_RELOCATION_ENTRY *block, SIZE_T entriesNum, DWORD page, PVOID modulePtr, SIZE_T moduleSize)
#define RELOC_32BIT_FIELD
Operating on PE file's relocations table.