Windows安全之PE結構(七)之重定位表(Relocation Table)結構分析

什麼是重定位呢..
是把我們一些地址,重新定位的意思。

我們都知道每個程序在windows系統中 都有自己4GB的虛擬空間, 可是如果在WIN系統只有.EXE這樣一種PE文件的話。真是沒有重定位的重要性存在,可是事實有動態鏈接庫.DLL檔 , DLL檔本身自己是沒有一個虛擬空間,而他是需要被加載到不同的.EXE的私有空間中, 當加載後 有什麼基址是需要重定位呢? 就是DLL中的一些牽涉到直接尋址的一些指令 就需要進行重定位處理

直接尋址:
簡單意義就是在匯編代碼中 看到有 [XXXXXXX] 的語句 基本上都需要重定位

間接尋址:
這是額外知識, 匯編語言可以把一個地址存入eax 然後透過eax去尋址,這個eax就不需要重定位了


那重定位 究竟需要什麼呢??

首先一定是需要重定位的地方
然後就是重定位的結果


如下圖





dec dword ptr [100030000]
push dword ptr [10003000]
mov eax, dword ptr[10003000]

這三個地址是需要進行重定位的,因為這是反匯編.dll檔後的靜態地址,加載後這個地址就不一樣了

假如加載後 dll在exe檔中的虛擬基地址是0x20000000 那0x20000000h - 0x10000000h = 0x10000000

這裡0x20000000是假設加載dll模塊到exe的虛擬空間後,他的基址是0x20000000 他如 預設DLL的基址 相差了10000000H 那我們就需要把dll中所有的直接尋址 後移10000000H

以上面的例子就是
dec dword ptr [200030000]
push dword ptr [20003000]
mov eax, dword ptr[20003000]
可是我們怎麼知道重定位表有多少個內容需要重定位呢??


整個.reloc區塊就如下圖



IMAGE_BASE_RELOCATION STRUCT
  VirtualAddress DWORD ?    ;重定位表的rva
  SizeOfBlock    DWORD ?    ;重定位表的大小
  TypeOffset     WORD  ?    ;每一項佔一個字(兩個byte)
IMAGE_BASE_RELOCATION ENDS


TypeOffset是一個數組,數組每項大小為兩個字節(16位), 高4位是重定位的類型,低12位是偏移地址 ,它與VirtualAddress相加 就是虛擬偏移地址

透過很早以前說的一個 每一章都用到的數組DataDirectory 獲取重定位表的位置
然後定位到哪個區塊, 再換成物理地址, 用UltraEDIT打開,最後可以看到









這個看圖可以看到 重定位表基址為0x11000

3DE5 ,去掉高4位加上重定位表的RVA, 11000h+ DE5 = 11DE5h
3E8F ,去掉高4位加上重定位表的RVA, 11000h+ E8F = 11E8Fh
3EE2 ,去掉高4位加上重定位表的RVA, 11000h+ EE2 = 11EE2h

最後用DASM查看一下目標地址 這裡要把以上計算好的偏移加上原來的基址 即0x10000000










這樣所有需要重定位的位置 都被證明是直接尋址的一些語句了

Comments

Post a Comment

Popular posts from this blog

Android Kernel Development - Kernel compilation and Hello World

Image
Introduction Due to the lack of the material that clearly kick off the  android kernel development , hopefully it will gives the clearer  guide to develop your own android driver and debugging it. p.s. Due to the version differential, this article  is not ensure all of the Android Version , SDK version,  source  code , and   Emulator is compatible , however,  the door of   research is always opened,   just   feel   free   to contact me  and play together :P All the materials   are also  saved   in   the VM  ,   you can just directly leverage  the  existing VM Image for  development or  alternatively, as a research and studying, follow the following guide  to create your own workplace.  Android kernel didn't have dynamically insmod like the other linux, so this tutorial is trying to build a new Android Kernel and make test our kernel driver as well. Material Ubuntu 18.04.2 LTS  Android studio Android ndk-r10 Android SDK Goldfish v3.10 VMWare 15   
Read more

How does Nested-Virtualization works?

Image
What is Nested virtualization? ----------------------------------------------------------------------------------------------------- Nowadays, Software Security is becoming more important criteria in the industry, and in recent years, virtualization as a popular topic for protecting / attacking a software, however, most of the virtualization technology framework (bluepill-liked) is not provide an ability that let a guest virtualize one more layer, we called it "Nested Virtualization", level 2. Basic Virtual Machine Monitor Architecture ------------------------------------------------------------------------------------------------------ Figure[1] Host VMM trap any type of event which wants to monitor, such as, Interrupt, exception, privileged register access, one of this event is VMX instruction, after VMM loaded, VMM can always monitor a any one of the  VMX instructions, which provide a good chance for us. As following chart: Figure[2] VMM Life Cycle
Read more

Understanding ACPI and Device Tree

Image
This blog document and help to understand how ACPI works AML (ACPI Machine Language) AML is compiled binary that written in the ACPI Source Language (ASL) and it is interpreted binary that interpreted by AML interpreter during OS runtime. AML is provided by hardware manufacture and embedded in the firmware, it provides the entire device base hierarchy (all thing that equipped on your motherboard, and cannot be removed.) and function to OS that could interface the dedicated hardware, like PCI-ISA bridge or processor, controlling the power, turn on/off, etc. AML operated by different object type, and defined in definition block in firmware table (DSDT / SSDT) AML object type Scope String   Constant Package Control Method Device   ACPI Object  Naming Convention 1. All object names are 32 bits long. 2. The first byte of a name must be one of 'A' - 'Z', '_'. 3. Each of the remaining bytes of a name must be one of 'A' - 'Z', '0' - '
Read more