| 560 | } |
| 561 | |
| 562 | void IATReferenceScan::patchDirectJumpTableEntry(DWORD_PTR targetIatPointer, DWORD_PTR stdImagebase, DWORD directImportsJumpTableRVA, PeParser * peParser, BYTE * jmpTableMemory, DWORD newIatBase ) |
| 563 | { |
| 564 | DWORD patchBytes = 0; |
| 565 | for (std::vector<IATReference>::iterator iter = iatDirectImportList.begin(); iter != iatDirectImportList.end(); iter++) |
| 566 | { |
| 567 | IATReference * ref = &(*iter); |
| 568 | |
| 569 | //only one jmp in table for different direct imports with same iat address |
| 570 | if (ref->targetPointer == targetIatPointer) |
| 571 | { |
| 572 | //patch dump |
| 573 | DWORD patchOffset = (DWORD)peParser->convertRVAToOffsetRelative(ref->addressVA - ImageBase); |
| 574 | int index = peParser->convertRVAToOffsetVectorIndex(ref->addressVA - ImageBase); |
| 575 | BYTE * memory = peParser->getSectionMemoryByIndex(index); |
| 576 | DWORD memorySize = peParser->getSectionMemorySizeByIndex(index); |
| 577 | DWORD sectionRVA = peParser->getSectionAddressRVAByIndex(index); |
| 578 | |
| 579 | if (ref->type == IAT_REFERENCE_DIRECT_CALL || ref->type == IAT_REFERENCE_DIRECT_JMP) |
| 580 | { |
| 581 | #ifndef _WIN64 |
| 582 | if (ref->instructionSize == 5) |
| 583 | { |
| 584 | patchBytes = directImportsJumpTableRVA - (ref->addressVA - ImageBase) - 5; |
| 585 | patchDirectImportInDump32(1, 5, patchBytes, memory, memorySize, false, patchOffset, sectionRVA); |
| 586 | } |
| 587 | #endif |
| 588 | } |
| 589 | else if (ref->type == IAT_REFERENCE_DIRECT_PUSH || ref->type == IAT_REFERENCE_DIRECT_MOV) |
| 590 | { |
| 591 | #ifndef _WIN64 |
| 592 | if (ref->instructionSize == 5) //for x86 |
| 593 | { |
| 594 | patchBytes = directImportsJumpTableRVA + stdImagebase; |
| 595 | patchDirectImportInDump32(1, 5, patchBytes, memory, memorySize, true, patchOffset, sectionRVA); |
| 596 | } |
| 597 | #else |
| 598 | if (ref->instructionSize == 10) //for x64 |
| 599 | { |
| 600 | DWORD_PTR patchBytes64 = directImportsJumpTableRVA + stdImagebase; |
| 601 | patchDirectImportInDump64(2, 10, patchBytes64, memory, memorySize, true, patchOffset, sectionRVA); |
| 602 | } |
| 603 | #endif |
| 604 | } |
| 605 | else if (ref->type == IAT_REFERENCE_DIRECT_LEA) |
| 606 | { |
| 607 | #ifndef _WIN64 |
| 608 | if (ref->instructionSize == 6) |
| 609 | { |
| 610 | patchBytes = directImportsJumpTableRVA + stdImagebase; |
| 611 | patchDirectImportInDump32(2, 6, patchBytes, memory, memorySize, true, patchOffset, sectionRVA); |
| 612 | } |
| 613 | #endif |
| 614 | } |
| 615 | } |
| 616 | } |
| 617 | } |
| 618 | |
| 619 | void IATReferenceScan::patchDirectJumpTable( DWORD_PTR stdImagebase, DWORD directImportsJumpTableRVA, PeParser * peParser, BYTE * jmpTableMemory, DWORD newIatBase ) |
nothing calls this directly
no test coverage detected