avast / avast/retdec

loader: Relocations for PE

Open
#206 0 comments 0 reactions 0 assignees View on GitHub
C-loader new-feature T-format-pe
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

There are very few PE binaries, which abuse PE relocations to for example hide original import table or other important structures. There are ways you can force Windows loader to use relocations every time the binary is run like:

1. Zero `ImageBase`
2. `ImageBase` set to address space reserved for kernel (MSB is set to 1)

It would make sense to interpret relocations for PE files. The problem is that it would all happen in `loader` which comes after `fileformat`. If relocations are abused for PE header modification, we would need to somehow return back to `fileformat` and from there to `pelib` which is currently impossible.

This ticket serves just as reminder that there are binaries which abuse relocations, but I don't think that this ticket is going to be solved in the near future.

SHA256 of such files:
```
d05852cbe47e363f3d3858d62697c4a05cbbb82645f5531eb0c3b21e9ce9d8f6
543b6328b781fec5a41b406d39b7e2474898c31fdbdc58f1b44f033bdcde698d
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the loader, fileformat, and pelib stages to understand how PE headers and relocations are currently handled. Investigate the supplied SHA256 samples to reproduce the relocation-abuse cases. Done means PE relocations are interpreted even when the image base forces relocation, including cases where relocations modify important PE structures.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.