[question]pe---relocationtableprint

2016wapjpc · 发表于 2016-6-24 17:45

这一周要打印pe重定位表，好难呀

2016wapjpc · 发表于 2016-6-25 09:00

本帖最后由 2016wapjpc 于 2016-6-29 22:11 编辑

重定位表的关键部分的实现

[code]
VOID TestPrintRelactionD()
{


            DWORD size = 0;

            LPVOID pFileBuffer = NULL;

            PIMAGE_DOS_HEADER pDosHeader = NULL;

            PIMAGE_NT_HEADERS pNTHeader = NULL;

            PIMAGE_FILE_HEADER pPEHeader = NULL;

            PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;

            PIMAGE_SECTION_HEADER pSectionHeader = NULL;




               size = ReadPEFile(FILEPATH_IN,&pFileBuffer);

            pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;

            pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pFileBuffer+pDosHeader->e_lfanew);

            DWORD dwRva  =       pNTHeader->OptionalHeader.DataDirectory[5].VirtualAddress;

                     //relaction data table  foa
            DWORD ReloactionFileAddr = RvaToFileOffset( pFileBuffer, dwRva);

                  //fisrt relaction table
         PIMAGE_BASE_RELOCATION pRelcation =(PIMAGE_BASE_RELOCATION)((DWORD)pFileBuffer+ ReloactionFileAddr );

            //print data rva and blocks
         printf("第 1个RelVirtualAddress = %x\t SizeOfBlock= %X \n ",pRelcation->VirtualAddress ,pRelcation->SizeOfBlock);


         DWORD numofReloc=(pRelcation->SizeOfBlock -0x8 )/2 ;

         WORD minioffset=0;
            // to locate address to be modified
         WORD *pRelocData=(WORD*)((DWORD)pRelcation+0x8 );

                     for(DWORD i = 0;i <  numofReloc ;i++)
                     {
                              DWORD RelocAddress=0;
                              if (((*pRelocData)>>12)==3)
                              {
                                 minioffset=(*pRelocData)  & 0xFFF    ;
                                 DWORD       addressRVa= (pRelcation->VirtualAddress+ minioffset);
                              RelocAddress = RvaToFileOffset( pFileBuffer, addressRVa);
                              printf("%d rel-Rva: %x \t Address: %x\n",i+1,addressRVa, RelocAddress);

                              }
                     }

         break;

}

[code]