-
Notifications
You must be signed in to change notification settings - Fork 742
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
PE loader needs to process relocations #5
Comments
Ah I just looked at the loader code in more detail, and it looks like you are actually already doing relocations. But unfortunately the loader does not consider that the base address might be too high, and just allocates memory from image base onwards. Thus the crash happens already before any actual image loading happens. |
As usual, please send pull req to fix the issue, if you can :-)
|
Will take a look at it |
I added some code to limit the PE base address and relocate the PE, but the pefile's relocate_image api will have an error when relocating the |
* delete win_setup.bat clean up unnecessary files * Update usage.md syncing merge #95 * using pip current for unicorn * unicorn head with pip * using -e for pip install * test 3 pip github * git install #4 * pip github test #5 * pip install github #6 * src installation unicorn engine * src install unicorn engine * src installation * src install test #7 * revert travis * Update qltool section in README.md * Enable docker test with Travis-CI * update readme and enable docker travis-ci testing Co-authored-by: chfl4gs <chbse64@gmail.com>
* delete win_setup.bat clean up unnecessary files * Update usage.md syncing merge #95 * using pip current for unicorn * unicorn head with pip * using -e for pip install * test 3 pip github * git install #4 * pip github test #5 * pip install github #6 * src installation unicorn engine * src install unicorn engine * src installation * src install test #7 * revert travis * fix travis * fix travis parser error * travis error fixed * fix travis error * fix travis indent error * Revert "fix travis error" This reverts commit c72c42c. * run docker with privileged mode * docker test with privilege * remove osx from allow_failures Co-authored-by: chfl4gs <chbse64@gmail.com>
Consider the
reloaderd sample (from this year's FlareOn): This crashes the loader, as it tries to directly map the PE at a location that is intentionally defined to mess with loaders. The PE loading mechanism should consider using relocations if the image base is just too high to work.
The text was updated successfully, but these errors were encountered: