portable executable - Best way to fix IAT and relocs when patching (merging) two different binaries (x86 PE)? -
first of - hello , thank reading this,
i have 1 dll not have source code need add functionalities it.
i made dll implementing these needed functionalities in c - using visual studio.
now need insert generated code new dll target dll (it has done @ file level {not @ runtime}).
i creating new pe section on target dll , put there code/data/rdata dll made up. problem need somehow fix iat , relocs relative new inserted code on target dll.
my question is:
what best way it?
it nice if visual studio came option build using (mostly) relative addressing - save me lot when dealing relocs. guess encapsulate vars , constants struct, msvc need relocate address of "container" struct , use relative addressing access members. don't know if idea.
i go further , rid of iat making function pointer dynamically load needed function module (kind of delay load module). , again, put function pointer inside "container" struct said before.
the last option have make hand, manually editing binary in hex... didn`t want do, because take time every single iat entry , reloc entry. have written pe file encryptor time ago know of inner workings , know can done, want know thoughts , maybe tool exists me out?
any suggestions highly appreciated!
thanks again time reading this!
since asking suggestions, take @ portable executable file format – reverse engineer view pdf document. section "adding code pe file" describes techniques (and presents tools) add code existing pe image without having code of target image (your scenario) manipulation iat table , sections tables.
Comments
Post a Comment