-------------------------------------------------------------------------
| 27 | { |
| 28 | //------------------------------------------------------------------------- |
| 29 | DWORD64 ExtractRelocations( |
| 30 | HANDLE hProcess, |
| 31 | DWORD64 baseOfImage, |
| 32 | DWORD64 imageBaseRelocationPtr, |
| 33 | int sizeOfPointer, |
| 34 | std::unordered_set<DWORD64>& relocations) |
| 35 | { |
| 36 | auto imageBaseRelocation = Tools::ReadStructInProcessMemory<IMAGE_BASE_RELOCATION>( |
| 37 | hProcess, imageBaseRelocationPtr); |
| 38 | auto sizeOfBlock = imageBaseRelocation->SizeOfBlock; |
| 39 | auto count = (sizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD); |
| 40 | |
| 41 | std::vector<WORD> relocationPtrs(count); |
| 42 | Tools::ReadProcessMemory( |
| 43 | hProcess, |
| 44 | imageBaseRelocationPtr + sizeof(IMAGE_BASE_RELOCATION), |
| 45 | &relocationPtrs[0], |
| 46 | relocationPtrs.size() * sizeof(WORD)); |
| 47 | |
| 48 | for (auto relocationPtr : relocationPtrs) |
| 49 | { |
| 50 | auto relocationType = (relocationPtr & 0xf000) >> 12; |
| 51 | |
| 52 | if (relocationType == IMAGE_REL_BASED_HIGHLOW || relocationType == IMAGE_REL_BASED_DIR64) |
| 53 | { |
| 54 | auto rva = relocationPtr & 0x0fff; |
| 55 | auto relocationAddress = imageBaseRelocation->VirtualAddress + rva + baseOfImage; |
| 56 | DWORD_PTR relocationValue = 0; |
| 57 | Tools::ReadProcessMemory(hProcess, relocationAddress, &relocationValue, sizeOfPointer); |
| 58 | |
| 59 | auto relocation = relocationValue - baseOfImage; |
| 60 | relocations.insert(relocation); |
| 61 | } |
| 62 | } |
| 63 | |
| 64 | return sizeOfBlock; |
| 65 | } |
| 66 | |
| 67 | //------------------------------------------------------------------------- |
| 68 | struct RelocationsDirectoryInfo |
no test coverage detected