Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
Visual C++ produces binaries with .code, .rdata, and .data sections (in that order). Themida merges all three into a nameless section, which is detrimental to analysis. In particular, I want to run the Extra Pass plugin for IDA on a dump from memory of a Themida'd executable (imports not recovered), but it needs the real bounds of the .code section or it will aggressively convert a lot of actual data into code.
How could I go about recovering the base of the .rdata and .data sections?
Basically the best way to start doing this is to compile your own EXE (with the same compiler as the Themida protected file when possible) and try to merge the sections by yourself. I crafted an example for you (source code: http://codepad.org/RqNiH3Ly, download RAR (merged + directly compiled): https://mega.co.nz/#!aoAUALBJ!6riSM4VmT43Ywf_jxQAY73EsVXyjEAAhJ1rOSGaYdeI, just some executable I was working with at the moment, compiled with VS10).
The base of the .data section can basically be found by searching for references to every address aligned to 0x1000 in the code (VS10 uses data pointers in order, so just scroll up to the base of the first section and look for a pointer). For example:
01251000 /$ 81EC 0C010000 SUB ESP,10C
01251006 |. A1 00302501 MOV EAX,DWORD PTR DS:[1253000] ; pointer to .data
0125100B |. 33C4 XOR EAX,ESP
In my case (the EXE also has relocations) the ImageBase was 0x1250000, so the RVA of the .data section would be 0x1253000 - 0x1250000 = 0x3000
The .rdata section is just the RVA aligned up to 0x1000 from the actual end of the code (you can learn this from the original file). In this case:
012518E2 $- FF25 60202501 JMP DWORD PTR DS:[<&MSVCR100._except_han>
012518E8 $- FF25 64202501 JMP DWORD PTR DS:[<&MSVCR100._invoke_wat>
012518EE $- FF25 68202501 JMP DWORD PTR DS:[<&MSVCR100.controlfp> ; end
012518F4 00 DB 00
012518F5 00 DB 00
0x12518EE - 0x1250000 = 0x18EE, rounded up 0x2000, so the original RVA of the .rdata section is 0x2000.
Similar calculations can be done for the .reloc section (search for the binary mask "3? 3? 3? 3? 3?" will get you pretty close on x86).
Just learn to know the compiler structure and use it to recover something similar to the original (maybe Themida just appends the raw section data and changes all data pointers etc). Hope this helps a little :)
