BanMe
January 7th, 2011, 21:51
I was looking over the internet for relocation samples and found the one for morphine only after approaching it the same way, so I decided to go another way and would like some advice, on how to proceed further.
Here is the where I start this fairytale begins and lays the ruins of past 'zen' coding...posted to http://www.reverse-engineering.net/viewtopic.php?f=7&t=8082&sid=c7461d190f0c780485b6f9e62a5a4967
to which I have taken it far off topic..But w.e.
I have wanted to understand relocation in order to build one that works in reverse of this(if that makes sense). I have been trying to put together a relocation parser and then came up with a idea,but the parse comes first..so here is my code,I'm really trying to learn new asm instructions.. any thoughts ?
uses 3 register parameters eax,ecx,edx.
uses 2 stack locations +8,+C
5 parameters in total.
.inc
updated 1/12/2011..
included below is 3 object files and the 'batch' file I used to compile the test dll, as well as source code for all 3 obj files. I used masm latest edition, and polink to compile the fastcall routines. If you cannot tell there is a int 3 in the code on purpose..still debugging..
I deleted materials to which I thought where not needed..in this string of posts.
Here is the where I start this fairytale begins and lays the ruins of past 'zen' coding...posted to http://www.reverse-engineering.net/viewtopic.php?f=7&t=8082&sid=c7461d190f0c780485b6f9e62a5a4967
to which I have taken it far off topic..But w.e.
I have wanted to understand relocation in order to build one that works in reverse of this(if that makes sense). I have been trying to put together a relocation parser and then came up with a idea,but the parse comes first..so here is my code,I'm really trying to learn new asm instructions.. any thoughts ?
uses 3 register parameters eax,ecx,edx.
uses 2 stack locations +8,+C
5 parameters in total.
.inc
Code:
@Relocate@16 PROTO SYSCALL
Relocate <@Relocate@16>
updated 1/12/2011..
Code:
.486
.model flat
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\ntdll.inc
includelib \masm32\lib\ntdll.lib
extern hInstWORD
.code
Relocate proc FASTCALL MemTable:PVOID,NearFunction
;this part is dependent on this function being executed after RtlImageDirectoryEntryToData
and ebx,0ffff0000h;I should calc the delta..*this bit taken from morphine*
add ebx,[ebx+3Ch];dos to NT headers
mov ebx,[ebx+034h];NT.(prefered)ImageBase
sub edx,ebx;delta
;dependent part ends.
;start function
test eax,eax;test if eax is a value..(it should be .reloc address..)
jz reloc_parse_end
mov edi,ecx;ecx is the pointer to my piece of memory(_tls_data).
mov esi,eax
cld;forward
push edi;is my data table I want to create..
;this is what I want it to look like.
;edi+0 Total number of entries
;HEADER_START
;edi+4 Relocation Block Offset
;edi+8 Size of block
;edi+C Number of Entries in block
;HEADER_END
;edi+10 first block entry
;...
;HEADER_START
;repeat that header for further blocks
int 3
add edi,4;save a area for Total
movsd;write block offset to edi increments( esi, edi)
movsd;write Block size to edi increments( esi, edi)
process_block:
mov eax,[edi-4];get total sizeof relocation block;
sub eax,8;sub IMAGE_BASE_RELOCATION size from size of block to get size of entries.
shr eax,1;divide by 2 to get number of entries
push eax;store entries to stack
mov ecx,eax;store number of entries in counter for loop with processing.
stosd;write eax to edi increments edi.
reloc_parse_highlow:
xor ebx,ebx;clear ebx
xor eax,eax;clear eax
lodsw;load a entry to eax
mov ebx,eax;copy it for processing
and eax,0fffh;clear top bit to get offset
shr ebx,12;clear lowe 3 bit to get type
sub ebx,3;check if I found IMAGE_REL_BASED_HIGHLOW
add eax,hInst;ugly hack for testing o0
add eax,edx;ImageBase + offset+delta
stosd;store entry to table
loopnz reloc_parse_highlow;loop number of entries in ecx
pop ecx;get current entries processed
pop eax;get base or Total entries
add [eax], ecx;accumalate Total entries.
push eax;store base again
mov eax,[esi];check if there is another block
test eax,eax;test if zero
jz check_table_datalocations;if no more blocks start processing data in table, else..
mov edx,eax;.
movsd
movsd
jmp process_block
reloc_parse_end:
ret
check_table_datalocations:
pop esi;get base of my structured table
lodsd;total number of entries
test eax,eax;check to see if there are any.
je reloc_parse_end;if not end
mov edx,eax.
lodsd;reloc base
lodsd;reloc sizeof block
lodsd;number of entries
mov ecx,eax
check_table_for_imports:
jmp reloc_parse_end
check_section_for_data:
ImportFound:
jmp reloc_parse_end
Relocate endp
included below is 3 object files and the 'batch' file I used to compile the test dll, as well as source code for all 3 obj files. I used masm latest edition, and polink to compile the fastcall routines. If you cannot tell there is a int 3 in the code on purpose..still debugging..
I deleted materials to which I thought where not needed..in this string of posts.
