-
-
[原创]分享甲壳2部分源码之重定位:Relocation
-
发表于: 2011-9-15 11:09 3852
-
void Relocation(DWORD pdll) { PIMAGE_DOS_HEADER pdos=(PIMAGE_DOS_HEADER)pdll; PIMAGE_NT_HEADERS pnh=(PIMAGE_NT_HEADERS)((DWORD)pdll+pdos->e_lfanew); IMAGE_DATA_DIRECTORY idd=pnh->OptionalHeader.DataDirectory[5]; if (idd.VirtualAddress==NULL) { return; } PIMAGE_BASE_RELOCATION rel=(PIMAGE_BASE_RELOCATION)(pdll+idd.VirtualAddress); WORD* pre=(WORD*)(rel+1); PWORDLH poffset; DWORD newvalue,*buf1; //对全局变量进行重定位 PWORD pw; while(rel->VirtualAddress!=0) { DWORD resize=(rel->SizeOfBlock-8)/2; for (DWORD i=0;i<resize;i++) { poffset=(PWORDLH)pre; pw=(PWORD)pre[0]; switch (poffset->high) { case IMAGE_REL_BASED_ABSOLUTE://0 //MessageBoxA(0,"0","重定位",0); break; case IMAGE_REL_BASED_HIGH://1 //MessageBoxA(0,"1","重定位",0); break; case IMAGE_REL_BASED_LOW://2 //MessageBoxA(0,"2","重定位",0); break; case IMAGE_REL_BASED_HIGHLOW://3 buf1=(DWORD*)(rel->VirtualAddress+poffset->low+pdll); newvalue=*buf1+pdll-pnh->OptionalHeader.ImageBase; *buf1=newvalue; break; case IMAGE_REL_BASED_HIGHADJ://4 //MessageBoxA(0,"4","重定位",0); break; case IMAGE_REL_BASED_MIPS_JMPADDR://5 //MessageBoxA(0,"5","重定位",0); break; case IMAGE_REL_BASED_MIPS_JMPADDR16://9 //MessageBoxA(0,"9","重定位",0); break; } pre+=1; } rel = (PIMAGE_BASE_RELOCATION) ((DWORD)rel + (DWORD)rel->SizeOfBlock); pre=(WORD*)(rel+1); } }
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!
赞赏
他的文章
看原图
赞赏
雪币:
留言: