loader: Relocations for PE
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
There are very few PE binaries, which abuse PE relocations to for example hide original import table or other important structures. There are ways you can force Windows loader to use relocations every time the binary is run like:
1. Zero `ImageBase`
2. `ImageBase` set to address space reserved for kernel (MSB is set to 1)
It would make sense to interpret relocations for PE files. The problem is that it would all happen in `loader` which comes after `fileformat`. If relocations are abused for PE header modification, we would need to somehow return back to `fileformat` and from there to `pelib` which is currently impossible.
This ticket serves just as reminder that there are binaries which abuse relocations, but I don't think that this ticket is going to be solved in the near future.
SHA256 of such files:
```
d05852cbe47e363f3d3858d62697c4a05cbbb82645f5531eb0c3b21e9ce9d8f6
543b6328b781fec5a41b406d39b7e2474898c31fdbdc58f1b44f033bdcde698d
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the loader, fileformat, and pelib stages to understand how PE headers and relocations are currently handled. Investigate the supplied SHA256 samples to reproduce the relocation-abuse cases. Done means PE relocations are interpreted even when the image base forces relocation, including cases where relocations modify important PE structures.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100