Method patchDirectJumpTable

Scylla/IATReferenceScan.cpp:619–657

}

void IATReferenceScan::patchDirectJumpTable( DWORD_PTR stdImagebase, DWORD directImportsJumpTableRVA, PeParser * peParser, BYTE * jmpTableMemory, DWORD newIatBase )
{

	std::set<DWORD_PTR> apiPointers;
	for (std::vector<IATReference>::iterator iter = iatDirectImportList.begin(); iter != iatDirectImportList.end(); iter++)
	{
		IATReference * ref = &(*iter);
		apiPointers.insert(ref->targetPointer);
	}

	DWORD patchBytes;

	for (std::set<DWORD_PTR>::iterator apiIter = apiPointers.begin(); apiIter != apiPointers.end(); apiIter++)
	{
		DWORD_PTR refTargetPointer = *apiIter;
		if (newIatBase) //create new iat in section
		{
			refTargetPointer = (*apiIter - IatAddressVA) + newIatBase + ImageBase;
		}
		//create jump table in section
		DWORD_PTR newIatAddressPointer = refTargetPointer - ImageBase + stdImagebase;

#ifdef _WIN64
		patchBytes = (DWORD)(newIatAddressPointer - (directImportsJumpTableRVA + stdImagebase) - 6);
#else
		patchBytes = newIatAddressPointer;
		DWORD relocOffset = (directImportsJumpTableRVA + 2);
		directImportLog.log(L"Relocation direct imports fix: Base RVA %08X Type HIGHLOW Offset %04X RelocTableEntry %04X", relocOffset & 0xFFFFF000, relocOffset & 0x00000FFF, (IMAGE_REL_BASED_HIGHLOW << 12) + (relocOffset & 0x00000FFF));
#endif
		jmpTableMemory[0] = 0xFF;
		jmpTableMemory[1] = 0x25;
		*((DWORD *)&jmpTableMemory[2]) = patchBytes;

		patchDirectJumpTableEntry(*apiIter, stdImagebase, directImportsJumpTableRVA, peParser, jmpTableMemory, newIatBase);

		jmpTableMemory += 6;
		directImportsJumpTableRVA += 6;
	}
}

void IATReferenceScan::patchDirectImportInDump32( int patchPreFixBytes, int instructionSize, DWORD patchBytes, BYTE * memory, DWORD memorySize, bool generateReloc, DWORD patchOffset, DWORD sectionRVA )
{