4

Now working on binary analysis of PE and stuck on tricky (for me), ungoogleable question.

For instance, I've binary, that needs to be patched. So after doing that will be awesome, if there is way to insert address of my function to relocation table. The following picture can illustrate thing I'm talking about.

Relocated functions in binary

So, as you can see, relocated functions marked pale, and my function is not in the relocation table. What should I patch to add my function into relocation table? Tried CFF Explorer with no luck. All the patches was made in hiew.

  • If you managed to solve the question, then just post an answer below and mark it as the answer. Also it would be helpful to type the actual names for tools to facilitate search. – Dmitry Janushkevich Jul 2 '14 at 11:54
6

Issue solved. For that moment tested several utilities for relocation patching.

RelocEditor - didn't solve the issue, but maybe for some future researchers who will face with similar task will find it useful

Reloc Rebuilder - actually solved issue. Just select patched executable and app should fix the relocation table.

Relocation Section Editor - didn't tried myself, but should also work. Link here because of purposes as in first item.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.