#include #include "pe_relocations.h" #include "pe_properties_generic.h" namespace pe_bliss { using namespace pe_win; //RELOCATIONS //Default constructor relocation_entry::relocation_entry() :rva_(0), type_(0) {} //Constructor from relocation item (WORD) relocation_entry::relocation_entry(uint16_t relocation_value) :rva_(relocation_value & ((1 << 12) - 1)), type_(relocation_value >> 12) {} //Constructor from relative rva and relocation type relocation_entry::relocation_entry(uint16_t rrva, uint16_t type) :rva_(rrva), type_(type) {} //Returns RVA of relocation uint16_t relocation_entry::get_rva() const { return rva_; } //Returns type of relocation uint16_t relocation_entry::get_type() const { return type_; } //Sets RVA of relocation void relocation_entry::set_rva(uint16_t rva) { rva_ = rva; } //Sets type of relocation void relocation_entry::set_type(uint16_t type) { type_ = type; } //Returns relocation item (rrva + type) uint16_t relocation_entry::get_item() const { return rva_ | (type_ << 12); } //Sets relocation item (rrva + type) void relocation_entry::set_item(uint16_t item) { rva_ = item & ((1 << 12) - 1); type_ = item >> 12; } //Returns relocation list const relocation_table::relocation_list& relocation_table::get_relocations() const { return relocations_; } //Adds relocation to table void relocation_table::add_relocation(const relocation_entry& entry) { relocations_.push_back(entry); } //Default constructor relocation_table::relocation_table() :rva_(0) {} //Constructor from RVA of relocation table relocation_table::relocation_table(uint32_t rva) :rva_(rva) {} //Returns RVA of block uint32_t relocation_table::get_rva() const { return rva_; } //Sets RVA of block void relocation_table::set_rva(uint32_t rva) { rva_ = rva; } //Returns changeable relocation list relocation_table::relocation_list& relocation_table::get_relocations() { return relocations_; } //Get relocation list of pe file, supports one-word sized relocations only //If list_absolute_entries = true, IMAGE_REL_BASED_ABSOLUTE will be listed const relocation_table_list get_relocations(const pe_base& pe, bool list_absolute_entries) { relocation_table_list ret; //If image does not have relocations if(!pe.has_reloc()) return ret; //Check the length in bytes of the section containing relocation directory if(pe.section_data_length_from_rva(pe.get_directory_rva(image_directory_entry_basereloc), pe.get_directory_rva(image_directory_entry_basereloc), section_data_virtual, true) < sizeof(image_base_relocation)) throw pe_exception("Incorrect relocation directory", pe_exception::incorrect_relocation_directory); unsigned long current_pos = pe.get_directory_rva(image_directory_entry_basereloc); //First IMAGE_BASE_RELOCATION table image_base_relocation reloc_table = pe.section_data_from_rva(current_pos, section_data_virtual, true); if(reloc_table.SizeOfBlock % 2) throw pe_exception("Incorrect relocation directory", pe_exception::incorrect_relocation_directory); unsigned long reloc_size = pe.get_directory_size(image_directory_entry_basereloc); unsigned long read_size = 0; //reloc_table.VirtualAddress is not checked (not so important) while(reloc_table.SizeOfBlock && read_size < reloc_size) { //Create relocation table relocation_table table; //Save RVA table.set_rva(reloc_table.VirtualAddress); if(!pe_utils::is_sum_safe(current_pos, reloc_table.SizeOfBlock)) throw pe_exception("Incorrect relocation directory", pe_exception::incorrect_relocation_directory); //List all relocations for(unsigned long i = sizeof(image_base_relocation); i < reloc_table.SizeOfBlock; i += sizeof(uint16_t)) { relocation_entry entry(pe.section_data_from_rva(current_pos + i, section_data_virtual, true)); if(list_absolute_entries || entry.get_type() != image_rel_based_absolute) table.add_relocation(entry); } //Save table ret.push_back(table); //Go to next relocation block if(!pe_utils::is_sum_safe(current_pos, reloc_table.SizeOfBlock)) throw pe_exception("Incorrect relocation directory", pe_exception::incorrect_relocation_directory); current_pos += reloc_table.SizeOfBlock; read_size += reloc_table.SizeOfBlock; reloc_table = pe.section_data_from_rva(current_pos, section_data_virtual, true); } return ret; } //Simple relocations rebuilder //To keep PE file working, don't remove any of existing relocations in //relocation_table_list returned by a call to get_relocations() function //auto_strip_last_section - if true and relocations are placed in the last section, it will be automatically stripped //offset_from_section_start - offset from the beginning of reloc_section, where relocations data will be situated //If save_to_pe_header is true, PE header will be modified automatically const image_directory rebuild_relocations(pe_base& pe, const relocation_table_list& relocs, section& reloc_section, uint32_t offset_from_section_start, bool save_to_pe_header, bool auto_strip_last_section) { //Check that reloc_section is attached to this PE image if(!pe.section_attached(reloc_section)) throw pe_exception("Relocations section must be attached to PE file", pe_exception::section_is_not_attached); uint32_t current_reloc_data_pos = pe_utils::align_up(offset_from_section_start, sizeof(uint32_t)); uint32_t needed_size = current_reloc_data_pos - offset_from_section_start; //Calculate needed size for relocation tables uint32_t size_delta = needed_size; uint32_t start_reloc_pos = current_reloc_data_pos; //Enumerate relocation tables for(relocation_table_list::const_iterator it = relocs.begin(); it != relocs.end(); ++it) { needed_size += static_cast((*it).get_relocations().size() * sizeof(uint16_t) /* relocations */ + sizeof(image_base_relocation) /* table header */); //End of each table will be DWORD-aligned if((start_reloc_pos + needed_size - size_delta) % sizeof(uint32_t)) needed_size += sizeof(uint16_t); //Align it with IMAGE_REL_BASED_ABSOLUTE relocation } //Check if reloc_section is last one. If it's not, check if there's enough place for relocations data if(&reloc_section != &*(pe.get_image_sections().end() - 1) && (reloc_section.empty() || pe_utils::align_up(reloc_section.get_size_of_raw_data(), pe.get_file_alignment()) < needed_size + current_reloc_data_pos)) throw pe_exception("Insufficient space for relocations directory", pe_exception::insufficient_space); std::string& raw_data = reloc_section.get_raw_data(); //This will be done only if reloc_section is the last section of image or for section with unaligned raw length of data if(raw_data.length() < needed_size + current_reloc_data_pos) raw_data.resize(needed_size + current_reloc_data_pos); //Expand section raw data //Enumerate relocation tables for(relocation_table_list::const_iterator it = relocs.begin(); it != relocs.end(); ++it) { //Create relocation table header image_base_relocation reloc; reloc.VirtualAddress = (*it).get_rva(); const relocation_table::relocation_list& reloc_list = (*it).get_relocations(); reloc.SizeOfBlock = static_cast(sizeof(image_base_relocation) + sizeof(uint16_t) * reloc_list.size()); if((reloc_list.size() * sizeof(uint16_t)) % sizeof(uint32_t)) //If we must align end of relocation table reloc.SizeOfBlock += sizeof(uint16_t); memcpy(&raw_data[current_reloc_data_pos], &reloc, sizeof(reloc)); current_reloc_data_pos += sizeof(reloc); //Enumerate relocations in table for(relocation_table::relocation_list::const_iterator r = reloc_list.begin(); r != reloc_list.end(); ++r) { //Save relocations uint16_t reloc_value = (*r).get_item(); memcpy(&raw_data[current_reloc_data_pos], &reloc_value, sizeof(reloc_value)); current_reloc_data_pos += sizeof(reloc_value); } if(current_reloc_data_pos % sizeof(uint32_t)) //If end of table is not DWORD-aligned { memset(&raw_data[current_reloc_data_pos], 0, sizeof(uint16_t)); //Align it with IMAGE_REL_BASED_ABSOLUTE relocation current_reloc_data_pos += sizeof(uint16_t); } } image_directory ret(pe.rva_from_section_offset(reloc_section, start_reloc_pos), needed_size - size_delta); //Adjust section raw and virtual sizes pe.recalculate_section_sizes(reloc_section, auto_strip_last_section); //If auto-rewrite of PE headers is required if(save_to_pe_header) { pe.set_directory_rva(image_directory_entry_basereloc, ret.get_rva()); pe.set_directory_size(image_directory_entry_basereloc, ret.get_size()); pe.clear_characteristics_flags(image_file_relocs_stripped); pe.set_dll_characteristics(pe.get_dll_characteristics() | image_dllcharacteristics_dynamic_base); } return ret; } //Recalculates image base with the help of relocation tables void rebase_image(pe_base& pe, const relocation_table_list& tables, uint64_t new_base) { pe.get_pe_type() == pe_type_32 ? rebase_image_base(pe, tables, new_base) : rebase_image_base(pe, tables, new_base); } //RELOCATIONS //Recalculates image base with the help of relocation tables //Recalculates VAs of DWORDS/QWORDS in image according to relocations //Notice: if you move some critical structures like TLS, image relocations will not fix new //positions of TLS VAs. Instead, some bytes that now doesn't belong to TLS will be fixed. //It is recommended to rebase image in the very beginning and move all structures afterwards. template void rebase_image_base(pe_base& pe, const relocation_table_list& tables, uint64_t new_base) { //Get current image base value typename PEClassType::BaseSize image_base; pe.get_image_base(image_base); //ImageBase difference typename PEClassType::BaseSize base_rel = static_cast(static_cast(new_base) - image_base); //We need to fix addresses from relocation tables //Enumerate relocation tables for(relocation_table_list::const_iterator it = tables.begin(); it != tables.end(); ++it) { const relocation_table::relocation_list& relocs = (*it).get_relocations(); uint32_t base_rva = (*it).get_rva(); //Enumerate relocations for(relocation_table::relocation_list::const_iterator rel = relocs.begin(); rel != relocs.end(); ++rel) { //Skip ABSOLUTE entries if((*rel).get_type() == pe_win::image_rel_based_absolute) continue; //Recalculate value by RVA and rewrite it uint32_t current_rva = base_rva + (*rel).get_rva(); typename PEClassType::BaseSize value = pe.section_data_from_rva(current_rva, section_data_raw, true); value += base_rel; memcpy(pe.section_data_from_rva(current_rva, true), &value, sizeof(value)); } } //Finally, save new image base pe.set_image_base_64(new_base); } }