From f1c29d498df7f3af684a8f841296dd4a9f24c9d8 Mon Sep 17 00:00:00 2001 From: "Vasilyev, Viacheslav" Date: Wed, 22 Apr 2020 22:08:30 +0300 Subject: [PATCH] add x64 support --- Relocation Section Editor/PeHeaders.cs | 579 ++++++++++++++++++ .../Relocation Section Editor.csproj | 1 + Relocation Section Editor/Relocations.cs | 325 +++++----- .../frmAddRelocation.Designer.cs | 59 +- Relocation Section Editor/frmAddRelocation.cs | 14 +- .../frmEditRelocation.Designer.cs | 74 ++- .../frmEditRelocation.cs | 20 +- Relocation Section Editor/frmMain.Designer.cs | 166 +++-- Relocation Section Editor/frmMain.cs | 55 +- 9 files changed, 975 insertions(+), 318 deletions(-) create mode 100644 Relocation Section Editor/PeHeaders.cs diff --git a/Relocation Section Editor/PeHeaders.cs b/Relocation Section Editor/PeHeaders.cs new file mode 100644 index 0000000..d49b507 --- /dev/null +++ b/Relocation Section Editor/PeHeaders.cs @@ -0,0 +1,579 @@ +using System; +using System.Runtime.InteropServices; +using System.IO; + +namespace Relocation_Section_Editor +{ + public class PeHeader + { + // IMAGE_FILE_HEADER > Machine + public const UInt16 IMAGE_FILE_MACHINE_I386 = 0x014c; + public const UInt16 IMAGE_FILE_MACHINE_IA64 = 0x0200; + public const UInt16 IMAGE_FILE_MACHINE_AMD64 = 0x8664; + + // IMAGE_FILE_HEADER > Characteristics + public const UInt16 IMAGE_FILE_RELOCS_STRIPPED = 0x0001; + public const UInt16 IMAGE_FILE_EXECUTABLE_IMAGE = 0x0002; + public const UInt16 IMAGE_FILE_LINE_NUMS_STRIPPED = 0x0004; + public const UInt16 IMAGE_FILE_LOCAL_SYMS_STRIPPED = 0x0008; + public const UInt16 IMAGE_FILE_AGGRESIVE_WS_TRIM = 0x0010; + public const UInt16 IMAGE_FILE_LARGE_ADDRESS_AWARE = 0x0020; + public const UInt16 IMAGE_FILE_BYTES_REVERSED_LO = 0x0080; + public const UInt16 IMAGE_FILE_32BIT_MACHINE = 0x0100; + public const UInt16 IMAGE_FILE_DEBUG_STRIPPED = 0x0200; + public const UInt16 IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP = 0x0400; + public const UInt16 IMAGE_FILE_NET_RUN_FROM_SWAP = 0x0800; + public const UInt16 IMAGE_FILE_SYSTEM = 0x1000; + public const UInt16 IMAGE_FILE_DLL = 0x2000; + public const UInt16 IMAGE_FILE_UP_SYSTEM_ONLY = 0x4000; + public const UInt16 IMAGE_FILE_BYTES_REVERSED_HI = 0x8000; + + // IMAGE_OPTIONAL_HEADER > Subsystem + public const UInt16 IMAGE_SUBSYSTEM_UNKNOWN = 0; + public const UInt16 IMAGE_SUBSYSTEM_NATIVE = 1; + public const UInt16 IMAGE_SUBSYSTEM_WINDOWS_GUI = 2; + public const UInt16 IMAGE_SUBSYSTEM_WINDOWS_CUI = 3; + public const UInt16 IMAGE_SUBSYSTEM_OS2_CUI = 5; + public const UInt16 IMAGE_SUBSYSTEM_POSIX_CUI = 7; + public const UInt16 IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 9; + public const UInt16 IMAGE_SUBSYSTEM_EFI_APPLICATION = 10; + public const UInt16 IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER = 11; + public const UInt16 IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER = 12; + public const UInt16 IMAGE_SUBSYSTEM_EFI_ROM = 13; + public const UInt16 IMAGE_SUBSYSTEM_XBOX = 14; + public const UInt16 IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION = 16; + + // IMAGE_OPTIONAL_HEADER > DllCharacteristics + public const UInt16 IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = 0x0040; + public const UInt16 IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY = 0x0080; + public const UInt16 IMAGE_DLLCHARACTERISTICS_NX_COMPAT = 0x0100; + public const UInt16 IMAGE_DLLCHARACTERISTICS_NO_ISOLATION = 0x0200; + public const UInt16 IMAGE_DLLCHARACTERISTICS_NO_SEH = 0x0400; + public const UInt16 IMAGE_DLLCHARACTERISTICS_NO_BIND = 0x0800; + public const UInt16 IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = 0x2000; + public const UInt16 IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = 0x8000; + + // IMAGE_DOS_HEADER > e_magic + public const UInt16 IMAGE_DOS_SIGNATURE = 0x05A4D; + + // IMAGE_NT_HEADERS > Signature + public const UInt32 IMAGE_NT_SIGNATURE = 0x04550; + + // IMAGE_OPTIONAL_HEADER > Magic + public const UInt16 IMAGE_NT_OPTIONAL_HDR32_MAGIC = 0x10b; + public const UInt16 IMAGE_NT_OPTIONAL_HDR64_MAGIC = 0x20b; + + // IMAGE_DATA_DIRECTORY[IMAGE_OPTIONAL_HEADER > NumberOfRvaAndSizes] + public const UInt16 IMAGE_DIRECTORY_ENTRY_EXPORT = 0; + public const UInt16 IMAGE_DIRECTORY_ENTRY_IMPORT = 1; + public const UInt16 IMAGE_DIRECTORY_ENTRY_RESOURCE = 2; + public const UInt16 IMAGE_DIRECTORY_ENTRY_EXCEPTION = 3; + public const UInt16 IMAGE_DIRECTORY_ENTRY_SECURITY = 4; + public const UInt16 IMAGE_DIRECTORY_ENTRY_BASERELOC = 5; + public const UInt16 IMAGE_DIRECTORY_ENTRY_DEBUG = 6; + public const UInt16 IMAGE_DIRECTORY_ENTRY_ARCHITECTURE = 7; + public const UInt16 IMAGE_DIRECTORY_ENTRY_GLOBALPTR = 8; + public const UInt16 IMAGE_DIRECTORY_ENTRY_TLS = 9; + public const UInt16 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG = 10; + public const UInt16 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT = 11; + public const UInt16 IMAGE_DIRECTORY_ENTRY_IAT = 12; + public const UInt16 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT = 13; + public const UInt16 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR = 14; + + [StructLayout(LayoutKind.Sequential, Pack = 1)] + public struct IMAGE_DOS_HEADER + { + public UInt16 e_magic; + public UInt16 e_cblp; + public UInt16 e_cp; + public UInt16 e_crlc; + public UInt16 e_cparhdr; + public UInt16 e_minalloc; + public UInt16 e_maxalloc; + public UInt16 e_ss; + public UInt16 e_sp; + public UInt16 e_csum; + public UInt16 e_ip; + public UInt16 e_cs; + public UInt16 e_lfarlc; + public UInt16 e_ovno; + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] + public UInt16[] e_res; + public UInt16 e_oemid; + public UInt16 e_oeminfo; + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)] + public UInt16[] e_res2; + public UInt32 e_lfanew; + } + + [StructLayout(LayoutKind.Sequential, Pack = 1)] + public struct IMAGE_FILE_HEADER + { + public UInt16 Machine; + public UInt16 NumberOfSections; + public UInt32 TimeDateStamp; + public UInt32 PointerToSymbolTable; + public UInt32 NumberOfSymbols; + public UInt16 SizeOfOptionalHeader; + public UInt16 Characteristics; + } + + [StructLayout(LayoutKind.Sequential, Pack = 1)] + public struct IMAGE_NT_HEADERS64 + { + public UInt32 Signature; + public IMAGE_FILE_HEADER FileHeader; + public IMAGE_OPTIONAL_HEADER64 OptionalHeader; + } + + [StructLayout(LayoutKind.Sequential, Pack = 1)] + public struct IMAGE_NT_HEADERS32 + { + public UInt32 Signature; + public IMAGE_FILE_HEADER FileHeader; + public IMAGE_OPTIONAL_HEADER32 OptionalHeader; + } + + [StructLayout(LayoutKind.Sequential, Pack = 1)] + public struct IMAGE_OPTIONAL_HEADER32 + { + public UInt16 Magic; + public Byte MajorLinkerVersion; + public Byte MinorLinkerVersion; + public UInt32 SizeOfCode; + public UInt32 SizeOfInitializedData; + public UInt32 SizeOfUninitializedData; + public UInt32 AddressOfEntryPoint; + public UInt32 BaseOfCode; + public UInt32 BaseOfData; + public UInt32 ImageBase; + public UInt32 SectionAlignment; + public UInt32 FileAlignment; + public UInt16 MajorOperatingSystemVersion; + public UInt16 MinorOperatingSystemVersion; + public UInt16 MajorImageVersion; + public UInt16 MinorImageVersion; + public UInt16 MajorSubsystemVersion; + public UInt16 MinorSubsystemVersion; + public UInt32 Win32VersionValue; + public UInt32 SizeOfImage; + public UInt32 SizeOfHeaders; + public UInt32 CheckSum; + public UInt16 Subsystem; + public UInt16 DllCharacteristics; + public UInt32 SizeOfStackReserve; + public UInt32 SizeOfStackCommit; + public UInt32 SizeOfHeapReserve; + public UInt32 SizeOfHeapCommit; + public UInt32 LoaderFlags; + public UInt32 NumberOfRvaAndSizes; + //[MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] + //public IMAGE_DATA_DIRECTORY[] DataDirectory; + // + //public IMAGE_DATA_DIRECTORY ExportTableDirectory; + //public IMAGE_DATA_DIRECTORY ImportTableDirectory; + //public IMAGE_DATA_DIRECTORY ResourceTableDirectory; + //public IMAGE_DATA_DIRECTORY ExceptionTableDirectory; + //public IMAGE_DATA_DIRECTORY CertificateTableDirectory; + //public IMAGE_DATA_DIRECTORY BaseRelocationTableDirectory; + //public IMAGE_DATA_DIRECTORY DebugDirectory; + //public IMAGE_DATA_DIRECTORY ArchitectureDirectory; + //public IMAGE_DATA_DIRECTORY GlobalPtrDirectory; + //public IMAGE_DATA_DIRECTORY TLSTableDirectory; + //public IMAGE_DATA_DIRECTORY LoadConfigTableDirectory; + //public IMAGE_DATA_DIRECTORY BoundImportDirectory; + //public IMAGE_DATA_DIRECTORY IATDirectory; + //public IMAGE_DATA_DIRECTORY DelayImportDescriptorDirectory; + //public IMAGE_DATA_DIRECTORY CLRRuntimeHeaderDirectory; + //public IMAGE_DATA_DIRECTORY ReservedDirectory; + } + + [StructLayout(LayoutKind.Sequential, Pack = 1)] + public struct IMAGE_OPTIONAL_HEADER64 + { + public UInt16 Magic; + public Byte MajorLinkerVersion; + public Byte MinorLinkerVersion; + public UInt32 SizeOfCode; + public UInt32 SizeOfInitializedData; + public UInt32 SizeOfUninitializedData; + public UInt32 AddressOfEntryPoint; + public UInt32 BaseOfCode; + public UInt64 ImageBase; + public UInt32 SectionAlignment; + public UInt32 FileAlignment; + public UInt16 MajorOperatingSystemVersion; + public UInt16 MinorOperatingSystemVersion; + public UInt16 MajorImageVersion; + public UInt16 MinorImageVersion; + public UInt16 MajorSubsystemVersion; + public UInt16 MinorSubsystemVersion; + public UInt32 Win32VersionValue; + public UInt32 SizeOfImage; + public UInt32 SizeOfHeaders; + public UInt32 CheckSum; + public UInt16 Subsystem; + public UInt16 DllCharacteristics; + public UInt64 SizeOfStackReserve; + public UInt64 SizeOfStackCommit; + public UInt64 SizeOfHeapReserve; + public UInt64 SizeOfHeapCommit; + public UInt32 LoaderFlags; + public UInt32 NumberOfRvaAndSizes; + //[MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] + //public IMAGE_DATA_DIRECTORY[] DataDirectory; + // + //public IMAGE_DATA_DIRECTORY ExportTableDirectory; + //public IMAGE_DATA_DIRECTORY ImportTableDirectory; + //public IMAGE_DATA_DIRECTORY ResourceTableDirectory; + //public IMAGE_DATA_DIRECTORY ExceptionTableDirectory; + //public IMAGE_DATA_DIRECTORY CertificateTableDirectory; + //public IMAGE_DATA_DIRECTORY BaseRelocationTableDirectory; + //public IMAGE_DATA_DIRECTORY DebugDirectory; + //public IMAGE_DATA_DIRECTORY ArchitectureDirectory; + //public IMAGE_DATA_DIRECTORY GlobalPtrDirectory; + //public IMAGE_DATA_DIRECTORY TLSTableDirectory; + //public IMAGE_DATA_DIRECTORY LoadConfigTableDirectory; + //public IMAGE_DATA_DIRECTORY BoundImportDirectory; + //public IMAGE_DATA_DIRECTORY IATDirectory; + //public IMAGE_DATA_DIRECTORY DelayImportDescriptorDirectory; + //public IMAGE_DATA_DIRECTORY CLRRuntimeHeaderDirectory; + //public IMAGE_DATA_DIRECTORY ReservedDirectory; + } + + [StructLayout(LayoutKind.Sequential, Pack = 1)] + public struct IMAGE_DATA_DIRECTORY + { + public UInt32 RelativeVirtualAddress; + public UInt32 Size; + } + + [StructLayout(LayoutKind.Sequential, Pack = 1)] + public struct IMAGE_SECTION_HEADER + { + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)] + public Byte[] Name; + public UInt32 VirtualSize; + public UInt32 VirtualAddress; + public UInt32 SizeOfRawData; + public UInt32 PointerToRawData; + public UInt32 PointerToRelocations; + public UInt32 PointerToLinenumbers; + public UInt16 NumberOfRelocations; + public UInt16 NumberOfLinenumbers; + public DataSectionFlags Characteristics; + } + + [Flags] + public enum DataSectionFlags : UInt32 + { + TypeReg = 0x00000000, + TypeDsect = 0x00000001, + TypeNoLoad = 0x00000002, + TypeGroup = 0x00000004, + TypeNoPadded = 0x00000008, + TypeCopy = 0x00000010, + ContentCode = 0x00000020, + ContentInitializedData = 0x00000040, + ContentUninitializedData = 0x00000080, + LinkOther = 0x00000100, + LinkInfo = 0x00000200, + TypeOver = 0x00000400, + LinkRemove = 0x00000800, + LinkComDat = 0x00001000, + NoDeferSpecExceptions = 0x00004000, + RelativeGP = 0x00008000, + MemoryPurgeable = 0x00020000, + MemoryLocked = 0x00040000, + MemoryPreload = 0x00080000, + Align1Bytes = 0x00100000, + Align2Bytes = 0x00200000, + Align4Bytes = 0x00300000, + Align8Bytes = 0x00400000, + Align16Bytes = 0x00500000, + Align32Bytes = 0x00600000, + Align64Bytes = 0x00700000, + Align128Bytes = 0x00800000, + Align256Bytes = 0x00900000, + Align512Bytes = 0x00A00000, + Align1024Bytes = 0x00B00000, + Align2048Bytes = 0x00C00000, + Align4096Bytes = 0x00D00000, + Align8192Bytes = 0x00E00000, + LinkExtendedRelocationOverflow = 0x01000000, + MemoryDiscardable = 0x02000000, + MemoryNotCached = 0x04000000, + MemoryNotPaged = 0x08000000, + MemoryShared = 0x10000000, + MemoryExecute = 0x20000000, + MemoryRead = 0x40000000, + MemoryWrite = 0x80000000 + } + + [Serializable, StructLayout(LayoutKind.Sequential, Pack = 1)] + public struct IMAGE_RELOCATION_BLOCK + { + public UInt32 RvaOfPage; + public UInt32 SizeOfBlock; + } + + [Flags] + public enum BASE_RELOCATION_TYPE : Byte + { + IMAGE_REL_BASED_ABSOLUTE = 0, + IMAGE_REL_BASED_HIGH = 1, + IMAGE_REL_BASED_LOW = 2, + IMAGE_REL_BASED_HIGHLOW = 3, + IMAGE_REL_BASED_HIGHADJ = 4, + IMAGE_REL_BASED_MIPS_JMPADDR = 5, + IMAGE_REL_BASED_SECTION = 6, + IMAGE_REL_BASED_REL32 = 7, + IMAGE_REL_BASED_RESERVED = 8, + IMAGE_REL_BASED_MIPS_JMPADDR16 = 9, + IMAGE_REL_BASED_DIR64 = 10 + } + + public IMAGE_DOS_HEADER DosHeader { get; } + + public IMAGE_FILE_HEADER FileHeader { get; } + + public IMAGE_OPTIONAL_HEADER32 OptionalHeader32 { get; } + + public IMAGE_OPTIONAL_HEADER64 OptionalHeader64 { get; } + + public IMAGE_DATA_DIRECTORY[] DataDirectories { get; } + + public IMAGE_SECTION_HEADER[] ImageSectionHeaders { get; } + + public PeHeader(string filePath) + { + // Read in the DLL or EXE and get the timestamp + using (FileStream stream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.Read)) + { + BinaryReader reader = new BinaryReader(stream); + + // Read dos header + DosHeader = FromBinaryReader(reader); + + // Check MZ signature + if (DosHeader.e_magic != IMAGE_DOS_SIGNATURE) + { + reader.Close(); + throw new InvalidOperationException("Invalid MZ header signature was found"); + } + + // Add 4 bytes to the offset + reader.BaseStream.Seek(DosHeader.e_lfanew, SeekOrigin.Begin); + + // Check NT signature + UInt32 ntHeadersSignature = reader.ReadUInt32(); + if (ntHeadersSignature != IMAGE_NT_SIGNATURE) + { + reader.Close(); + throw new InvalidOperationException("Invalid NT header signature was found"); + } + + // Read file header + FileHeader = FromBinaryReader(reader); + if (this.Is32BitImage && this.Is32BitMachine) + { + // This is 32-bit image + OptionalHeader32 = FromBinaryReader(reader); + if (OptionalHeader32.Magic != IMAGE_NT_OPTIONAL_HDR32_MAGIC) + { + reader.Close(); + throw new InvalidOperationException("Malformed 32-bit image was found"); + } + + // Read directories + DataDirectories = new IMAGE_DATA_DIRECTORY[OptionalHeader32.NumberOfRvaAndSizes]; + for (uint dirNo = 0; dirNo < DataDirectories.Length; dirNo++) + { + DataDirectories[dirNo] = FromBinaryReader(reader); + } + } + else if (this.Is64BitMachine) + { + // This is 64-bit image + OptionalHeader64 = FromBinaryReader(reader); + if (OptionalHeader64.Magic != IMAGE_NT_OPTIONAL_HDR64_MAGIC) + { + reader.Close(); + throw new InvalidOperationException("Malformed 64-bit image was found"); + } + + // Read directories + DataDirectories = new IMAGE_DATA_DIRECTORY[OptionalHeader64.NumberOfRvaAndSizes]; + for (uint dirNo = 0; dirNo < DataDirectories.Length; dirNo++) + { + DataDirectories[dirNo] = FromBinaryReader(reader); + } + } + else + { + // This is unknown image + reader.Close(); + throw new InvalidOperationException("Unsupported image was found"); + } + + // Read sections + ImageSectionHeaders = new IMAGE_SECTION_HEADER[FileHeader.NumberOfSections]; + for (uint headerNo = 0; headerNo < ImageSectionHeaders.Length; headerNo++) + { + ImageSectionHeaders[headerNo] = FromBinaryReader(reader); + } + + // Finish + reader.Close(); + } + } + + public UInt32 GetOffsetFromRVA(UInt32 rva) + { + for (uint headerNo = 0; headerNo < ImageSectionHeaders.Length; headerNo++) + { + if ((rva >= ImageSectionHeaders[headerNo].VirtualAddress) && (rva < (ImageSectionHeaders[headerNo].VirtualAddress + ((ImageSectionHeaders[headerNo].VirtualSize > 0) ? ImageSectionHeaders[headerNo].VirtualSize : ImageSectionHeaders[headerNo].SizeOfRawData)))) + { + return (rva - (ImageSectionHeaders[headerNo].VirtualAddress - ImageSectionHeaders[headerNo].PointerToRawData)); + } + } + return 0; + } + + public Boolean IsValidDirectory(UInt16 imgDir) + { + return (imgDir >= IMAGE_DIRECTORY_ENTRY_EXPORT && imgDir <= DataDirectories.Length); + } + + public IMAGE_SECTION_HEADER GetSectionInfo(UInt16 imgDir) + { + if (IsValidDirectory(imgDir)) + { + for (uint headerNo = 0; headerNo < ImageSectionHeaders.Length; headerNo++) + { + if ((DataDirectories[imgDir].RelativeVirtualAddress >= ImageSectionHeaders[headerNo].VirtualAddress) && (DataDirectories[imgDir].RelativeVirtualAddress < (ImageSectionHeaders[headerNo].VirtualAddress + ((ImageSectionHeaders[headerNo].VirtualSize > 0) ? ImageSectionHeaders[headerNo].VirtualSize : ImageSectionHeaders[headerNo].SizeOfRawData)))) + { + return ImageSectionHeaders[headerNo]; + } + } + } + return new IMAGE_SECTION_HEADER { }; + } + + public UInt32 GetSectionIndex(UInt16 imgDir) + { + if (IsValidDirectory(imgDir)) + { + for (uint headerNo = 0; headerNo < ImageSectionHeaders.Length; headerNo++) + { + if ((DataDirectories[imgDir].RelativeVirtualAddress >= ImageSectionHeaders[headerNo].VirtualAddress) && (DataDirectories[imgDir].RelativeVirtualAddress < (ImageSectionHeaders[headerNo].VirtualAddress + ((ImageSectionHeaders[headerNo].VirtualSize > 0) ? ImageSectionHeaders[headerNo].VirtualSize : ImageSectionHeaders[headerNo].SizeOfRawData)))) + { + return headerNo; + } + } + } + return 0; + } + + public UInt32 GetDirectoryOffset(UInt16 imgDir) + { + if (IsValidDirectory(imgDir)) + { + if (this.Is32BitImage && this.Is32BitMachine) + { + return (UInt32)(DosHeader.e_lfanew + Marshal.SizeOf(typeof(IMAGE_NT_HEADERS32)) + Marshal.SizeOf(typeof(IMAGE_DATA_DIRECTORY)) * imgDir); + } + else if (this.Is64BitMachine) + { + return (UInt32)(DosHeader.e_lfanew + Marshal.SizeOf(typeof(IMAGE_NT_HEADERS64)) + Marshal.SizeOf(typeof(IMAGE_DATA_DIRECTORY)) * imgDir); + } + } + return 0; + } + + public IMAGE_DATA_DIRECTORY GetImageDirectory(UInt16 imgDir) + { + if (IsValidDirectory(imgDir)) + { + return DataDirectories[imgDir]; + } + return new IMAGE_DATA_DIRECTORY { }; + } + + public static T FromBinaryReader(BinaryReader reader) + { + // Read in a byte array + byte[] bytes = reader.ReadBytes(Marshal.SizeOf(typeof(T))); + + // Pin the managed memory while, copy it out the data, then unpin it + GCHandle handle = GCHandle.Alloc(bytes, GCHandleType.Pinned); + T theStructure = (T)Marshal.PtrToStructure(handle.AddrOfPinnedObject(), typeof(T)); + handle.Free(); + + return theStructure; + } + + public bool Is32BitImage + { + get + { + return (FileHeader.Characteristics & IMAGE_FILE_32BIT_MACHINE) == IMAGE_FILE_32BIT_MACHINE; + } + } + + public bool Is32BitMachine + { + get + { + return (FileHeader.Machine & IMAGE_FILE_MACHINE_I386) == IMAGE_FILE_MACHINE_I386; + } + } + + public bool Is64BitMachine + { + get + { + return (FileHeader.Machine & IMAGE_FILE_MACHINE_AMD64) == IMAGE_FILE_MACHINE_AMD64; + } + } + + public UInt32 GetImagebase32() + { + return OptionalHeader32.ImageBase; + } + + public UInt64 GetImagebase64() + { + return OptionalHeader64.ImageBase; + } + + public UInt64 GetImagebase32or64() + { + if (this.Is32BitImage && this.Is32BitMachine) + { + return OptionalHeader32.ImageBase; + } + else if (this.Is64BitMachine) + { + return OptionalHeader64.ImageBase; + } + return 0; + } + + public DateTime TimeStamp + { + get + { + // Timestamp is a date offset from 1970 + DateTime returnValue = new DateTime(1970, 1, 1, 0, 0, 0); + + // Add in the number of seconds since 1970/1/1 + returnValue = returnValue.AddSeconds(FileHeader.TimeDateStamp); + // Adjust to local timezone + returnValue += TimeZone.CurrentTimeZone.GetUtcOffset(returnValue); + + return returnValue; + } + } + } +} diff --git a/Relocation Section Editor/Relocation Section Editor.csproj b/Relocation Section Editor/Relocation Section Editor.csproj index aaf61c5..2c266d8 100644 --- a/Relocation Section Editor/Relocation Section Editor.csproj +++ b/Relocation Section Editor/Relocation Section Editor.csproj @@ -59,6 +59,7 @@ frmMain.cs + diff --git a/Relocation Section Editor/Relocations.cs b/Relocation Section Editor/Relocations.cs index d9803fa..b970838 100644 --- a/Relocation Section Editor/Relocations.cs +++ b/Relocation Section Editor/Relocations.cs @@ -2,44 +2,31 @@ using System.Collections.Generic; using System.IO; using System.Collections; +using System.Diagnostics; +using System.Text; +using System.Runtime.InteropServices; namespace Relocation_Section_Editor { public class Relocations { - public enum BASE_RELOCATION_TYPE - { - ABSOLUTE = 0, - HIGH = 1, - LOW = 2, - HIGHLOW = 3, - HIGHADJ = 4, - JMPADDR = 5, - MIPS_JMPADDR16 = 9, - DIR64 = 10 - } public struct Page { - public uint address; + public UInt64 address; public uint size; public uint count; } + public struct Reloc { public ushort offset; - public BASE_RELOCATION_TYPE type; + public PeHeader.BASE_RELOCATION_TYPE type; } - private uint imageBase; - private uint virtualAddress; - private uint virtualSize; - private uint RawAddress; - private uint RawSize; - - private long addressVirtualSize; + private SortedDictionary> pages; + private string filePath; - private SortedDictionary> pages; - private string path; + private PeHeader pehr; public bool IsNotSaved { get; private set; } @@ -53,101 +40,60 @@ public Relocations(string path) if (!File.Exists(path)) throw new FileNotFoundException(); - this.path = path; + this.filePath = path; this.IsNotSaved = false; - BinaryReader br = new BinaryReader(new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read)); + pehr = new PeHeader(path); - if (br.ReadInt16() != 0x5A4D) // MZ signature + if (!pehr.IsValidDirectory(PeHeader.IMAGE_DIRECTORY_ENTRY_BASERELOC)) { - br.Close(); - throw new InvalidOperationException("MZ"); + throw new InvalidOperationException("Image has no relocation table"); } - br.BaseStream.Seek(0x3C, SeekOrigin.Begin); // go to ptr to COFF File Header - br.BaseStream.Seek(br.ReadInt32(), SeekOrigin.Begin); // go to COFF File Header - - if (br.ReadInt32() != 0x00004550) // PE\0\0 + // reading relocation section data + using (FileStream stream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.Read)) { - br.Close(); - throw new InvalidOperationException("PE"); - } + BinaryReader reader = new BinaryReader(stream); - br.ReadUInt16(); // machine ID. Ignored - uint numbersOfSections = br.ReadUInt16(); + PeHeader.IMAGE_DATA_DIRECTORY baseRelocPtr = pehr.GetImageDirectory(PeHeader.IMAGE_DIRECTORY_ENTRY_BASERELOC); + PeHeader.IMAGE_SECTION_HEADER baseRelocSection = pehr.GetSectionInfo(PeHeader.IMAGE_DIRECTORY_ENTRY_BASERELOC); - br.BaseStream.Seek(20 - 4, SeekOrigin.Current); // go to magic number (PE or PE+ = x86 or x64) + reader.BaseStream.Seek(baseRelocSection.PointerToRawData, SeekOrigin.Begin); - if (br.ReadInt16() != 0x010B) - { - br.Close(); - throw new InvalidOperationException("X86"); - } + pages = new SortedDictionary>(); - br.BaseStream.Seek(26, SeekOrigin.Current); // go to ImageBase - imageBase = br.ReadUInt32(); - br.BaseStream.Seek(64 + 40, SeekOrigin.Current); // go to Data Directories -> Base Relocation Table + PeHeader.IMAGE_RELOCATION_BLOCK relBlock; - virtualAddress = br.ReadUInt32(); - addressVirtualSize = br.BaseStream.Position; - virtualSize = br.ReadUInt32(); - - br.BaseStream.Seek(80, SeekOrigin.Current); // jump to Section Table - - // find the RAW address/size - RawAddress = 0; - RawSize = 0; - - for (int i = 0; i < numbersOfSections; i++) - { - br.BaseStream.Seek(12, SeekOrigin.Current); - - if (br.ReadUInt32() == virtualAddress) + while (reader.BaseStream.Position < baseRelocSection.PointerToRawData + baseRelocPtr.Size) // 4K block loop { - RawSize = br.ReadUInt32(); - RawAddress = br.ReadUInt32(); - break; - } + relBlock = PeHeader.FromBinaryReader(reader); - br.BaseStream.Seek(24, SeekOrigin.Current); // place the pointer to the next section - } - - if (RawAddress == 0x00 || RawSize == 0x00) - { - br.Close(); - throw new InvalidOperationException("RAW"); - } + uint size = relBlock.SizeOfBlock; + uint count = (size - 8) / 2; - // reading relocation section - br.BaseStream.Seek(RawAddress, SeekOrigin.Begin); - - pages = new SortedDictionary>(); - - while (br.BaseStream.Position < RawAddress + virtualSize) // 4K block loop - { - uint address = br.ReadUInt32(); - uint size = br.ReadUInt32(); - uint count = (size - 8) / 2; + List relocs = new List(); - List relocs = new List(); + for (int i = 0; i < count; i++) // offsets loop + { + // WORD 0000000000000000b + // 0x3041 0011000001000001b + // 0X0FFF 0000111111111111b + ushort data = reader.ReadUInt16(); - for (int i = 0; i < count; i++) // offsets loop - { - ushort data = br.ReadUInt16(); - BASE_RELOCATION_TYPE type = (BASE_RELOCATION_TYPE)((data & 0xF000) >> 12); - ushort offset = (ushort)(data & 0x0FFF); + Reloc r = new Reloc + { + offset = (ushort)(data & 0x0FFF), + type = (PeHeader.BASE_RELOCATION_TYPE)(((data & 0xF000) >> 12) & 0xF) + }; - Reloc reloc = new Reloc(); - reloc.offset = offset; - reloc.type = type; + relocs.Add(r); + } - relocs.Add(reloc); + pages.Add(relBlock.RvaOfPage, relocs); } - pages.Add(address, relocs); + reader.Close(); } - - br.Close(); } /// @@ -157,12 +103,12 @@ public Relocations(string path) /// New address /// New type /// True if edited with success, else false - public bool EditRelocation(uint address, uint newAddress, BASE_RELOCATION_TYPE newType) + public bool EditRelocation(UInt64 address, UInt64 newAddress, PeHeader.BASE_RELOCATION_TYPE newType) { - uint oldAddress = (address & 0xFFFFF000) - imageBase; + UInt64 oldAddress = (address & 0xFFFFF000) - pehr.GetImagebase32or64(); ushort oldOffset = (ushort)(address & 0x00000FFF); - BASE_RELOCATION_TYPE oldType = BASE_RELOCATION_TYPE.ABSOLUTE; + PeHeader.BASE_RELOCATION_TYPE oldType = PeHeader.BASE_RELOCATION_TYPE.IMAGE_REL_BASED_ABSOLUTE; List relocs; if (!pages.TryGetValue(oldAddress, out relocs)) @@ -177,7 +123,7 @@ public bool EditRelocation(uint address, uint newAddress, BASE_RELOCATION_TYPE n } } - if (oldType == BASE_RELOCATION_TYPE.ABSOLUTE) + if (oldType == PeHeader.BASE_RELOCATION_TYPE.IMAGE_REL_BASED_ABSOLUTE) return false; // delete old address and add new address. If not success, restore old address @@ -199,12 +145,15 @@ public bool EditRelocation(uint address, uint newAddress, BASE_RELOCATION_TYPE n /// /// Address to remove /// True if removed with success, else false - public bool DeleteRelocation(uint address) + public bool DeleteRelocation(UInt64 address) { + PeHeader.IMAGE_DATA_DIRECTORY baseRelocPtr = pehr.GetImageDirectory(PeHeader.IMAGE_DIRECTORY_ENTRY_BASERELOC); + List relocs; // search if 4K address exists - if (!pages.TryGetValue((address & 0xFFFFF000) - imageBase, out relocs)) + UInt64 page = (address & 0xFFFFF000) - pehr.GetImagebase32or64(); + if (!pages.TryGetValue(page, out relocs)) return false; ushort offset = (ushort)(address & 0x0FFF); @@ -212,10 +161,10 @@ public bool DeleteRelocation(uint address) // search if offset exists foreach (Reloc reloc in relocs) { - if (reloc.offset == offset && reloc.type != BASE_RELOCATION_TYPE.ABSOLUTE) + if (reloc.offset == offset && reloc.type != PeHeader.BASE_RELOCATION_TYPE.IMAGE_REL_BASED_ABSOLUTE) { relocs.Remove(reloc); - virtualSize -= 2; + baseRelocPtr.Size -= 2; if (relocs.Count % 2 != 0) // align in 32bits { @@ -223,30 +172,31 @@ public bool DeleteRelocation(uint address) foreach (Reloc item in relocs) // search if align already exists { - if (item.offset == 0 && item.type == BASE_RELOCATION_TYPE.ABSOLUTE) + if (item.offset == 0 && item.type == PeHeader.BASE_RELOCATION_TYPE.IMAGE_REL_BASED_ABSOLUTE) { relocs.Remove(item); isAlignDeleted = true; - virtualSize -= 2; + baseRelocPtr.Size -= 2; break; } } if (!isAlignDeleted) // if no align reloc found, add it { - Reloc item = new Reloc(); - item.offset = 0; - item.type = BASE_RELOCATION_TYPE.ABSOLUTE; - + Reloc item = new Reloc + { + offset = 0, + type = PeHeader.BASE_RELOCATION_TYPE.IMAGE_REL_BASED_ABSOLUTE + }; relocs.Add(item); - virtualSize += 2; + baseRelocPtr.Size += 2; } } if (relocs.Count == 0) // remove page if nothing offset { - pages.Remove((address & 0xFFFFF000) - imageBase); - virtualSize -= 8; + pages.Remove(page); + baseRelocPtr.Size -= 8; } IsNotSaved = true; @@ -263,34 +213,41 @@ public bool DeleteRelocation(uint address) /// Address to add /// Type of relocation /// -1 if duplicated, 0 if not added, 1 if added a page and 2 if added only in reloc of page - public int AddRelocation(uint address, BASE_RELOCATION_TYPE type) + public int AddRelocation(UInt64 address, PeHeader.BASE_RELOCATION_TYPE type) { - if (address < imageBase) + PeHeader.IMAGE_DATA_DIRECTORY baseRelocPtr = pehr.GetImageDirectory(PeHeader.IMAGE_DIRECTORY_ENTRY_BASERELOC); + PeHeader.IMAGE_SECTION_HEADER baseRelocSection = pehr.GetSectionInfo(PeHeader.IMAGE_DIRECTORY_ENTRY_BASERELOC); + + if (address < pehr.GetImagebase32or64()) return 0; - uint page = (address & 0xFFFFF000) - imageBase; + UInt64 page = (address & 0xFFFFF000) - pehr.GetImagebase32or64(); ushort offset = (ushort)(address & 0x00000FFF); if (!pages.ContainsKey(page)) // create a new page if doesn't exists { - if (RawSize - virtualSize < 12) + if (baseRelocSection.SizeOfRawData - baseRelocPtr.Size < 12) return 0; List relocs = new List(); - Reloc reloc = new Reloc(); - reloc.offset = offset; - reloc.type = type; + Reloc reloc = new Reloc + { + offset = offset, + type = type + }; relocs.Add(reloc); - reloc = new Reloc(); - reloc.offset = 0; - reloc.type = BASE_RELOCATION_TYPE.ABSOLUTE; + reloc = new Reloc + { + offset = 0, + type = PeHeader.BASE_RELOCATION_TYPE.IMAGE_REL_BASED_ABSOLUTE + }; relocs.Add(reloc); pages.Add(page, relocs); - virtualSize += 12; + baseRelocPtr.Size += 12; IsNotSaved = true; return 1; @@ -304,7 +261,7 @@ public int AddRelocation(uint address, BASE_RELOCATION_TYPE type) foreach (Reloc item in relocs) // search if address already present { - if (item.offset == offset && item.type != BASE_RELOCATION_TYPE.ABSOLUTE) + if (item.offset == offset && item.type != PeHeader.BASE_RELOCATION_TYPE.IMAGE_REL_BASED_ABSOLUTE) return -1; } @@ -314,36 +271,37 @@ public int AddRelocation(uint address, BASE_RELOCATION_TYPE type) foreach (Reloc item in relocs) // search if align already exists { - if (item.offset == 0 && item.type == BASE_RELOCATION_TYPE.ABSOLUTE) + if (item.offset == 0 && item.type == PeHeader.BASE_RELOCATION_TYPE.IMAGE_REL_BASED_ABSOLUTE) { relocs.Remove(item); isAlignDeleted = true; - virtualSize -= 2; + baseRelocPtr.Size -= 2; break; } } if (!isAlignDeleted) // if no align reloc found, add it { - if (RawSize - virtualSize < 4) + if (baseRelocSection.SizeOfRawData - baseRelocPtr.Size < 4) return 0; - Reloc item = new Reloc(); - item.offset = 0; - item.type = BASE_RELOCATION_TYPE.ABSOLUTE; - + Reloc item = new Reloc + { + offset = 0, + type = PeHeader.BASE_RELOCATION_TYPE.IMAGE_REL_BASED_ABSOLUTE + }; relocs.Add(item); - virtualSize += 2; + baseRelocPtr.Size += 2; } } - Reloc reloc = new Reloc(); - reloc.offset = offset; - reloc.type = type; - + Reloc reloc = new Reloc + { + offset = offset, + type = type + }; relocs.Add(reloc); - - virtualSize += 2; + baseRelocPtr.Size += 2; IsNotSaved = true; return 2; @@ -358,16 +316,18 @@ public List GetPages() { List result = new List(); - SortedDictionary>.Enumerator enumerator = pages.GetEnumerator(); + SortedDictionary>.Enumerator enumerator = pages.GetEnumerator(); while (enumerator.MoveNext()) { - Page p = new Page(); - - p.address = enumerator.Current.Key + imageBase; - p.count = (uint)enumerator.Current.Value.Count; - p.size = (p.count * 2) + 8; + uint count = (uint)enumerator.Current.Value.Count; + Page p = new Page + { + address = enumerator.Current.Key + pehr.GetImagebase32or64(), + size = (count * 2) + 8, + count = count + }; result.Add(p); } @@ -380,18 +340,20 @@ public List GetPages() /// Base address of relocations /// List of relocations for this address /// True if relocations given with success, else false - public bool TryGetRelocs(uint baseAddress, out List relocs) + public bool TryGetRelocs(UInt64 baseAddress, out List relocs) { - return pages.TryGetValue(baseAddress - imageBase, out relocs); + UInt64 page = baseAddress - pehr.GetImagebase32or64(); + return pages.TryGetValue(page, out relocs); } /// /// Obtain the Size of Relocation section into the RAM /// /// The virtual size - public uint GetVirtuallSize() + public uint GetVirtualSize() { - return virtualSize; + PeHeader.IMAGE_DATA_DIRECTORY baseRelocPtr = pehr.GetImageDirectory(PeHeader.IMAGE_DIRECTORY_ENTRY_BASERELOC); + return baseRelocPtr.Size; } /// @@ -400,7 +362,8 @@ public uint GetVirtuallSize() /// The RAW size public uint GetRawSize() { - return RawSize; + PeHeader.IMAGE_SECTION_HEADER baseRelocSection = pehr.GetSectionInfo(PeHeader.IMAGE_DIRECTORY_ENTRY_BASERELOC); + return baseRelocSection.SizeOfRawData; } /// @@ -409,7 +372,36 @@ public uint GetRawSize() /// The file path public string GetPath() { - return path; + return filePath; + } + + /// + /// Obtain VirtualAddress + /// + /// VirtualAddress + public uint GetVirtualAddress() + { + PeHeader.IMAGE_DATA_DIRECTORY baseRelocPtr = pehr.GetImageDirectory(PeHeader.IMAGE_DIRECTORY_ENTRY_BASERELOC); + return baseRelocPtr.RelativeVirtualAddress; + } + + /// + /// Obtain ImageBase + /// + /// imageBase + public UInt64 GetImageBase() + { + return pehr.GetImagebase32or64(); + } + + /// + /// Obtain RawAddress + /// + /// RawAddress + public uint GetRawAddress() + { + PeHeader.IMAGE_SECTION_HEADER baseRelocSection = pehr.GetSectionInfo(PeHeader.IMAGE_DIRECTORY_ENTRY_BASERELOC); + return baseRelocSection.PointerToRawData; } /// @@ -418,15 +410,19 @@ public string GetPath() /// True if written with success, else false public bool WriteRelocations(string newPath = "") { - if (!File.Exists(path)) + PeHeader.IMAGE_DATA_DIRECTORY baseRelocPtr = pehr.GetImageDirectory(PeHeader.IMAGE_DIRECTORY_ENTRY_BASERELOC); + PeHeader.IMAGE_SECTION_HEADER baseRelocSection = pehr.GetSectionInfo(PeHeader.IMAGE_DIRECTORY_ENTRY_BASERELOC); + uint offsetVirtualSize = pehr.GetDirectoryOffset(PeHeader.IMAGE_DIRECTORY_ENTRY_BASERELOC) + 4; + + if (!File.Exists(filePath)) return false; - if (!string.IsNullOrEmpty(newPath) && newPath != path) // save as + if (!string.IsNullOrEmpty(newPath) && newPath != filePath) // save as { try { - File.Copy(path, newPath, true); - path = newPath; + File.Copy(filePath, newPath, true); + filePath = newPath; } catch (Exception) { @@ -434,33 +430,32 @@ public bool WriteRelocations(string newPath = "") } } - BinaryWriter bw = new BinaryWriter(new FileStream(path, FileMode.Open, FileAccess.Write, FileShare.None)); + BinaryWriter bw = new BinaryWriter(new FileStream(filePath, FileMode.Open, FileAccess.Write, FileShare.None)); // write new relocation size - bw.BaseStream.Seek(addressVirtualSize, SeekOrigin.Begin); - bw.Write((uint)virtualSize); + bw.BaseStream.Seek(offsetVirtualSize, SeekOrigin.Begin); + bw.Write(baseRelocPtr.Size); // go to beginning of relocation section - bw.BaseStream.Seek(RawAddress, SeekOrigin.Begin); + bw.BaseStream.Seek(baseRelocSection.PointerToRawData, SeekOrigin.Begin); - foreach (KeyValuePair> page in pages) + foreach (KeyValuePair> page in pages) { // write page - bw.Write(page.Key); - bw.Write(page.Value.Count * 2 + 8); + bw.Write((uint)(page.Key & 0x0FFFFFFFF)); + bw.Write((uint)(page.Value.Count * 2 + 8)); foreach (Reloc reloc in page.Value) { // write reloc - ushort temp = (ushort)((ushort)reloc.type << 12); - temp += reloc.offset; + ushort temp = (ushort)((((ushort)reloc.type << 12) & 0xF000) | (reloc.offset & 0xFFF)); bw.Write(temp); } } // fill the end with null bytes - while (bw.BaseStream.Position < RawAddress + RawSize) - bw.Write((int)0x00000000); + while (bw.BaseStream.Position < baseRelocSection.PointerToRawData + baseRelocSection.SizeOfRawData) + bw.Write((uint)0x00000000); bw.Close(); diff --git a/Relocation Section Editor/frmAddRelocation.Designer.cs b/Relocation Section Editor/frmAddRelocation.Designer.cs index c5c676f..e264f43 100644 --- a/Relocation Section Editor/frmAddRelocation.Designer.cs +++ b/Relocation Section Editor/frmAddRelocation.Designer.cs @@ -40,18 +40,20 @@ private void InitializeComponent() // lblAddress // this.lblAddress.AutoSize = true; - this.lblAddress.Location = new System.Drawing.Point(14, 15); + this.lblAddress.Location = new System.Drawing.Point(19, 18); + this.lblAddress.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); this.lblAddress.Name = "lblAddress"; - this.lblAddress.Size = new System.Drawing.Size(48, 13); + this.lblAddress.Size = new System.Drawing.Size(64, 17); this.lblAddress.TabIndex = 0; this.lblAddress.Text = "Address:"; // // lblType // this.lblType.AutoSize = true; - this.lblType.Location = new System.Drawing.Point(28, 41); + this.lblType.Location = new System.Drawing.Point(37, 50); + this.lblType.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); this.lblType.Name = "lblType"; - this.lblType.Size = new System.Drawing.Size(34, 13); + this.lblType.Size = new System.Drawing.Size(44, 17); this.lblType.TabIndex = 2; this.lblType.Text = "Type:"; // @@ -60,23 +62,28 @@ private void InitializeComponent() this.cboType.DropDownStyle = System.Windows.Forms.ComboBoxStyle.DropDownList; this.cboType.FormattingEnabled = true; this.cboType.Items.AddRange(new object[] { - "HIGH", - "LOW", - "HIGHLOW", - "HIGHADJ", - "JMPADDR", - "MIPS_JMPADDR16", - "DIR64"}); - this.cboType.Location = new System.Drawing.Point(82, 38); + "IMAGE_REL_BASED_HIGH", + "IMAGE_REL_BASED_LOW", + "IMAGE_REL_BASED_HIGHLOW", + "IMAGE_REL_BASED_HIGHADJ", + "IMAGE_REL_BASED_MIPS_JMPADDR", + "IMAGE_REL_BASED_SECTION", + "IMAGE_REL_BASED_REL32", + "IMAGE_REL_BASED_RESERVED", + "IMAGE_REL_BASED_MIPS_JMPADDR16", + "IMAGE_REL_BASED_DIR64"}); + this.cboType.Location = new System.Drawing.Point(109, 47); + this.cboType.Margin = new System.Windows.Forms.Padding(4); this.cboType.Name = "cboType"; - this.cboType.Size = new System.Drawing.Size(122, 21); + this.cboType.Size = new System.Drawing.Size(230, 24); this.cboType.TabIndex = 3; // // btnOK // - this.btnOK.Location = new System.Drawing.Point(26, 81); + this.btnOK.Location = new System.Drawing.Point(109, 100); + this.btnOK.Margin = new System.Windows.Forms.Padding(4); this.btnOK.Name = "btnOK"; - this.btnOK.Size = new System.Drawing.Size(75, 23); + this.btnOK.Size = new System.Drawing.Size(100, 28); this.btnOK.TabIndex = 4; this.btnOK.Text = "&OK"; this.btnOK.UseVisualStyleBackColor = true; @@ -85,9 +92,10 @@ private void InitializeComponent() // btnCancel // this.btnCancel.DialogResult = System.Windows.Forms.DialogResult.Cancel; - this.btnCancel.Location = new System.Drawing.Point(127, 81); + this.btnCancel.Location = new System.Drawing.Point(239, 100); + this.btnCancel.Margin = new System.Windows.Forms.Padding(4); this.btnCancel.Name = "btnCancel"; - this.btnCancel.Size = new System.Drawing.Size(75, 23); + this.btnCancel.Size = new System.Drawing.Size(100, 28); this.btnCancel.TabIndex = 5; this.btnCancel.Text = "&Cancel"; this.btnCancel.UseVisualStyleBackColor = true; @@ -95,10 +103,11 @@ private void InitializeComponent() // // txtAddress // - this.txtAddress.Location = new System.Drawing.Point(82, 12); - this.txtAddress.MaxLength = 8; + this.txtAddress.Location = new System.Drawing.Point(109, 15); + this.txtAddress.Margin = new System.Windows.Forms.Padding(4); + this.txtAddress.MaxLength = 16; this.txtAddress.Name = "txtAddress"; - this.txtAddress.Size = new System.Drawing.Size(68, 20); + this.txtAddress.Size = new System.Drawing.Size(230, 22); this.txtAddress.TabIndex = 1; this.txtAddress.KeyPress += new System.Windows.Forms.KeyPressEventHandler(this.txtAddress_KeyPress); this.txtAddress.KeyUp += new System.Windows.Forms.KeyEventHandler(this.txtAddress_KeyUp); @@ -106,19 +115,20 @@ private void InitializeComponent() // lblHexa // this.lblHexa.AutoSize = true; - this.lblHexa.Location = new System.Drawing.Point(66, 15); + this.lblHexa.Location = new System.Drawing.Point(88, 18); + this.lblHexa.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); this.lblHexa.Name = "lblHexa"; - this.lblHexa.Size = new System.Drawing.Size(18, 13); + this.lblHexa.Size = new System.Drawing.Size(22, 17); this.lblHexa.TabIndex = 6; this.lblHexa.Text = "0x"; // // frmAddRelocation // this.AcceptButton = this.btnOK; - this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F); + this.AutoScaleDimensions = new System.Drawing.SizeF(8F, 16F); this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; this.CancelButton = this.btnCancel; - this.ClientSize = new System.Drawing.Size(229, 121); + this.ClientSize = new System.Drawing.Size(372, 143); this.Controls.Add(this.btnCancel); this.Controls.Add(this.btnOK); this.Controls.Add(this.cboType); @@ -127,6 +137,7 @@ private void InitializeComponent() this.Controls.Add(this.lblAddress); this.Controls.Add(this.lblHexa); this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.FixedDialog; + this.Margin = new System.Windows.Forms.Padding(4); this.MaximizeBox = false; this.MinimizeBox = false; this.Name = "frmAddRelocation"; diff --git a/Relocation Section Editor/frmAddRelocation.cs b/Relocation Section Editor/frmAddRelocation.cs index e7a1c21..2227daf 100644 --- a/Relocation Section Editor/frmAddRelocation.cs +++ b/Relocation Section Editor/frmAddRelocation.cs @@ -10,8 +10,8 @@ namespace Relocation_Section_Editor { public partial class frmAddRelocation : Form { - private uint address; - private Relocations.BASE_RELOCATION_TYPE type; + private UInt64 address; + private PeHeader.BASE_RELOCATION_TYPE type; public frmAddRelocation() { @@ -30,13 +30,13 @@ private void btnCancel_Click(object sender, EventArgs e) private void btnOK_Click(object sender, EventArgs e) { - if (!uint.TryParse(txtAddress.Text, System.Globalization.NumberStyles.AllowHexSpecifier, null, out address)) + if (!UInt64.TryParse(txtAddress.Text, System.Globalization.NumberStyles.AllowHexSpecifier, null, out address)) { - MessageBox.Show("\"" + txtAddress.Text.ToUpper() + "\" isn't a valid address"); + MessageBox.Show("\"" + txtAddress.Text.ToUpper() + "\" isn't a valid address", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); return; } - type = (Relocations.BASE_RELOCATION_TYPE)(cboType.SelectedIndex + 1); + type = (PeHeader.BASE_RELOCATION_TYPE)(cboType.SelectedIndex + 1); this.DialogResult = System.Windows.Forms.DialogResult.OK; } @@ -52,12 +52,12 @@ private void txtAddress_KeyPress(object sender, KeyPressEventArgs e) e.Handled = true; } - public uint GetAddress() + public UInt64 GetAddress() { return address; } - public Relocations.BASE_RELOCATION_TYPE GetRelocType() + public PeHeader.BASE_RELOCATION_TYPE GetRelocType() { return type; } diff --git a/Relocation Section Editor/frmEditRelocation.Designer.cs b/Relocation Section Editor/frmEditRelocation.Designer.cs index 1d12500..6538c37 100644 --- a/Relocation Section Editor/frmEditRelocation.Designer.cs +++ b/Relocation Section Editor/frmEditRelocation.Designer.cs @@ -43,9 +43,10 @@ private void InitializeComponent() // btnCancel // this.btnCancel.DialogResult = System.Windows.Forms.DialogResult.Cancel; - this.btnCancel.Location = new System.Drawing.Point(127, 91); + this.btnCancel.Location = new System.Drawing.Point(254, 122); + this.btnCancel.Margin = new System.Windows.Forms.Padding(4); this.btnCancel.Name = "btnCancel"; - this.btnCancel.Size = new System.Drawing.Size(75, 23); + this.btnCancel.Size = new System.Drawing.Size(100, 28); this.btnCancel.TabIndex = 6; this.btnCancel.Text = "&Cancel"; this.btnCancel.UseVisualStyleBackColor = true; @@ -53,9 +54,10 @@ private void InitializeComponent() // // btnOK // - this.btnOK.Location = new System.Drawing.Point(26, 91); + this.btnOK.Location = new System.Drawing.Point(124, 122); + this.btnOK.Margin = new System.Windows.Forms.Padding(4); this.btnOK.Name = "btnOK"; - this.btnOK.Size = new System.Drawing.Size(75, 23); + this.btnOK.Size = new System.Drawing.Size(100, 28); this.btnOK.TabIndex = 5; this.btnOK.Text = "&OK"; this.btnOK.UseVisualStyleBackColor = true; @@ -66,78 +68,89 @@ private void InitializeComponent() this.cboType.DropDownStyle = System.Windows.Forms.ComboBoxStyle.DropDownList; this.cboType.FormattingEnabled = true; this.cboType.Items.AddRange(new object[] { - "HIGH", - "LOW", - "HIGHLOW", - "HIGHADJ", - "JMPADDR", - "MIPS_JMPADDR16", - "DIR64"}); - this.cboType.Location = new System.Drawing.Point(93, 64); + "IMAGE_REL_BASED_HIGH", + "IMAGE_REL_BASED_LOW", + "IMAGE_REL_BASED_HIGHLOW", + "IMAGE_REL_BASED_HIGHADJ", + "IMAGE_REL_BASED_MIPS_JMPADDR", + "IMAGE_REL_BASED_SECTION", + "IMAGE_REL_BASED_REL32", + "IMAGE_REL_BASED_RESERVED", + "IMAGE_REL_BASED_MIPS_JMPADDR16", + "IMAGE_REL_BASED_DIR64"}); + this.cboType.Location = new System.Drawing.Point(124, 79); + this.cboType.Margin = new System.Windows.Forms.Padding(4); this.cboType.Name = "cboType"; - this.cboType.Size = new System.Drawing.Size(122, 21); + this.cboType.Size = new System.Drawing.Size(230, 24); this.cboType.TabIndex = 4; // // lblType // this.lblType.AutoSize = true; - this.lblType.Location = new System.Drawing.Point(39, 67); + this.lblType.Location = new System.Drawing.Point(52, 82); + this.lblType.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); this.lblType.Name = "lblType"; - this.lblType.Size = new System.Drawing.Size(34, 13); + this.lblType.Size = new System.Drawing.Size(44, 17); this.lblType.TabIndex = 3; this.lblType.Text = "Type:"; // // txtAddress // - this.txtAddress.Location = new System.Drawing.Point(93, 12); + this.txtAddress.Location = new System.Drawing.Point(124, 15); + this.txtAddress.Margin = new System.Windows.Forms.Padding(4); this.txtAddress.MaxLength = 8; this.txtAddress.Name = "txtAddress"; this.txtAddress.ReadOnly = true; - this.txtAddress.Size = new System.Drawing.Size(68, 20); + this.txtAddress.Size = new System.Drawing.Size(230, 22); this.txtAddress.TabIndex = 9; // // lblAddress // this.lblAddress.AutoSize = true; - this.lblAddress.Location = new System.Drawing.Point(25, 15); + this.lblAddress.Location = new System.Drawing.Point(33, 18); + this.lblAddress.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); this.lblAddress.Name = "lblAddress"; - this.lblAddress.Size = new System.Drawing.Size(48, 13); + this.lblAddress.Size = new System.Drawing.Size(64, 17); this.lblAddress.TabIndex = 7; this.lblAddress.Text = "Address:"; // // lblHexa // this.lblHexa.AutoSize = true; - this.lblHexa.Location = new System.Drawing.Point(77, 15); + this.lblHexa.Location = new System.Drawing.Point(103, 18); + this.lblHexa.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); this.lblHexa.Name = "lblHexa"; - this.lblHexa.Size = new System.Drawing.Size(18, 13); + this.lblHexa.Size = new System.Drawing.Size(22, 17); this.lblHexa.TabIndex = 8; this.lblHexa.Text = "0x"; // // lblNewAddress // this.lblNewAddress.AutoSize = true; - this.lblNewAddress.Location = new System.Drawing.Point(0, 38); + this.lblNewAddress.Location = new System.Drawing.Point(0, 50); + this.lblNewAddress.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); this.lblNewAddress.Name = "lblNewAddress"; - this.lblNewAddress.Size = new System.Drawing.Size(73, 13); + this.lblNewAddress.Size = new System.Drawing.Size(95, 17); this.lblNewAddress.TabIndex = 0; this.lblNewAddress.Text = "New Address:"; // // lblHexa2 // this.lblHexa2.AutoSize = true; - this.lblHexa2.Location = new System.Drawing.Point(77, 40); + this.lblHexa2.Location = new System.Drawing.Point(103, 50); + this.lblHexa2.Margin = new System.Windows.Forms.Padding(4, 0, 4, 0); this.lblHexa2.Name = "lblHexa2"; - this.lblHexa2.Size = new System.Drawing.Size(18, 13); + this.lblHexa2.Size = new System.Drawing.Size(22, 17); this.lblHexa2.TabIndex = 1; this.lblHexa2.Text = "0x"; // // txtNewAddress // - this.txtNewAddress.Location = new System.Drawing.Point(93, 38); - this.txtNewAddress.MaxLength = 8; + this.txtNewAddress.Location = new System.Drawing.Point(124, 47); + this.txtNewAddress.Margin = new System.Windows.Forms.Padding(4); + this.txtNewAddress.MaxLength = 16; this.txtNewAddress.Name = "txtNewAddress"; - this.txtNewAddress.Size = new System.Drawing.Size(68, 20); + this.txtNewAddress.Size = new System.Drawing.Size(230, 22); this.txtNewAddress.TabIndex = 2; this.txtNewAddress.KeyPress += new System.Windows.Forms.KeyPressEventHandler(this.txtNewAddress_KeyPress); this.txtNewAddress.KeyUp += new System.Windows.Forms.KeyEventHandler(this.txtNewAddress_KeyUp); @@ -145,10 +158,10 @@ private void InitializeComponent() // frmEditRelocation // this.AcceptButton = this.btnOK; - this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F); + this.AutoScaleDimensions = new System.Drawing.SizeF(8F, 16F); this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; this.CancelButton = this.btnCancel; - this.ClientSize = new System.Drawing.Size(229, 121); + this.ClientSize = new System.Drawing.Size(372, 163); this.Controls.Add(this.txtNewAddress); this.Controls.Add(this.lblHexa2); this.Controls.Add(this.lblNewAddress); @@ -160,6 +173,7 @@ private void InitializeComponent() this.Controls.Add(this.lblAddress); this.Controls.Add(this.lblHexa); this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.FixedDialog; + this.Margin = new System.Windows.Forms.Padding(4); this.MaximizeBox = false; this.MinimizeBox = false; this.Name = "frmEditRelocation"; diff --git a/Relocation Section Editor/frmEditRelocation.cs b/Relocation Section Editor/frmEditRelocation.cs index 826a7cb..c5fb178 100644 --- a/Relocation Section Editor/frmEditRelocation.cs +++ b/Relocation Section Editor/frmEditRelocation.cs @@ -10,11 +10,11 @@ namespace Relocation_Section_Editor { public partial class frmEditRelocation : Form { - private uint oldAddress; - private uint newAddress; - private Relocations.BASE_RELOCATION_TYPE type; + private UInt64 oldAddress; + private UInt64 newAddress; + private PeHeader.BASE_RELOCATION_TYPE type; - public frmEditRelocation(uint oldAddress, Relocations.BASE_RELOCATION_TYPE oldType) + public frmEditRelocation(UInt64 oldAddress, PeHeader.BASE_RELOCATION_TYPE oldType) { InitializeComponent(); @@ -42,28 +42,28 @@ private void txtNewAddress_KeyPress(object sender, KeyPressEventArgs e) private void btnOK_Click(object sender, EventArgs e) { - if (!uint.TryParse(txtNewAddress.Text, System.Globalization.NumberStyles.AllowHexSpecifier, null, out newAddress)) + if (!UInt64.TryParse(txtNewAddress.Text, System.Globalization.NumberStyles.AllowHexSpecifier, null, out newAddress)) { - MessageBox.Show("\"" + txtNewAddress.Text.ToUpper() + "\" isn't a valid address"); + MessageBox.Show("\"" + txtNewAddress.Text.ToUpper() + "\" isn't a valid address", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); return; } - type = (Relocations.BASE_RELOCATION_TYPE)(cboType.SelectedIndex + 1); + type = (PeHeader.BASE_RELOCATION_TYPE)(cboType.SelectedIndex + 1); this.DialogResult = System.Windows.Forms.DialogResult.OK; } - public uint GetOldAddress() + public UInt64 GetOldAddress() { return oldAddress; } - public uint GetNewAddress() + public UInt64 GetNewAddress() { return newAddress; } - public Relocations.BASE_RELOCATION_TYPE GetRelocType() + public PeHeader.BASE_RELOCATION_TYPE GetRelocType() { return type; } diff --git a/Relocation Section Editor/frmMain.Designer.cs b/Relocation Section Editor/frmMain.Designer.cs index bd8e200..f6d0f00 100644 --- a/Relocation Section Editor/frmMain.Designer.cs +++ b/Relocation Section Editor/frmMain.Designer.cs @@ -33,6 +33,7 @@ private void InitializeComponent() this.mnuMainFile = new System.Windows.Forms.ToolStripMenuItem(); this.mnuMainFileOpen = new System.Windows.Forms.ToolStripMenuItem(); this.mnuMainFileSave = new System.Windows.Forms.ToolStripMenuItem(); + this.mnuMainFileSaveAs = new System.Windows.Forms.ToolStripMenuItem(); this.toolStripSeparator1 = new System.Windows.Forms.ToolStripSeparator(); this.mnuMainFileExit = new System.Windows.Forms.ToolStripMenuItem(); this.mnuMainHelp = new System.Windows.Forms.ToolStripMenuItem(); @@ -40,6 +41,7 @@ private void InitializeComponent() this.sptMain = new System.Windows.Forms.SplitContainer(); this.grpPage = new System.Windows.Forms.GroupBox(); this.lvPage = new System.Windows.Forms.ListView(); + this.colPageVA = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); this.colPageRVA = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); this.colBlockSize = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); this.colCount = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); @@ -49,7 +51,10 @@ private void InitializeComponent() this.cmnuPagesDelete = new System.Windows.Forms.ToolStripMenuItem(); this.grpRelocation = new System.Windows.Forms.GroupBox(); this.lvRelocation = new System.Windows.Forms.ListView(); + this.colOffsetVA = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); + this.colItemRaw = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); this.colOffset = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); + this.colOffsetRVA = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); this.colType = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); this.cmnuRelocations = new System.Windows.Forms.ContextMenuStrip(this.components); this.cmnuRelocationsAdd = new System.Windows.Forms.ToolStripMenuItem(); @@ -58,10 +63,11 @@ private void InitializeComponent() this.cmnuRelocationsDelete = new System.Windows.Forms.ToolStripMenuItem(); this.dlgOpen = new System.Windows.Forms.OpenFileDialog(); this.staInfo = new System.Windows.Forms.StatusStrip(); + this.staLblImageBase = new System.Windows.Forms.ToolStripStatusLabel(); + this.staLblVirtualAddress = new System.Windows.Forms.ToolStripStatusLabel(); this.staLblCurrentSize = new System.Windows.Forms.ToolStripStatusLabel(); this.staLblMaxSize = new System.Windows.Forms.ToolStripStatusLabel(); this.staPbSize = new System.Windows.Forms.ToolStripProgressBar(); - this.mnuMainFileSaveAs = new System.Windows.Forms.ToolStripMenuItem(); this.dlgSave = new System.Windows.Forms.SaveFileDialog(); this.mnuMain.SuspendLayout(); this.sptMain.Panel1.SuspendLayout(); @@ -76,12 +82,13 @@ private void InitializeComponent() // // mnuMain // + this.mnuMain.ImageScalingSize = new System.Drawing.Size(20, 20); this.mnuMain.Items.AddRange(new System.Windows.Forms.ToolStripItem[] { this.mnuMainFile, this.mnuMainHelp}); this.mnuMain.Location = new System.Drawing.Point(0, 0); this.mnuMain.Name = "mnuMain"; - this.mnuMain.Size = new System.Drawing.Size(796, 24); + this.mnuMain.Size = new System.Drawing.Size(1221, 28); this.mnuMain.TabIndex = 0; this.mnuMain.Text = "menuStrip1"; // @@ -94,14 +101,14 @@ private void InitializeComponent() this.toolStripSeparator1, this.mnuMainFileExit}); this.mnuMainFile.Name = "mnuMainFile"; - this.mnuMainFile.Size = new System.Drawing.Size(37, 20); + this.mnuMainFile.Size = new System.Drawing.Size(46, 24); this.mnuMainFile.Text = "&File"; // // mnuMainFileOpen // this.mnuMainFileOpen.Name = "mnuMainFileOpen"; this.mnuMainFileOpen.ShortcutKeys = ((System.Windows.Forms.Keys)((System.Windows.Forms.Keys.Control | System.Windows.Forms.Keys.O))); - this.mnuMainFileOpen.Size = new System.Drawing.Size(191, 22); + this.mnuMainFileOpen.Size = new System.Drawing.Size(242, 26); this.mnuMainFileOpen.Text = "&Open..."; this.mnuMainFileOpen.Click += new System.EventHandler(this.mnuMainFileOpen_Click); // @@ -109,20 +116,29 @@ private void InitializeComponent() // this.mnuMainFileSave.Name = "mnuMainFileSave"; this.mnuMainFileSave.ShortcutKeys = ((System.Windows.Forms.Keys)((System.Windows.Forms.Keys.Control | System.Windows.Forms.Keys.S))); - this.mnuMainFileSave.Size = new System.Drawing.Size(191, 22); + this.mnuMainFileSave.Size = new System.Drawing.Size(242, 26); this.mnuMainFileSave.Text = "&Save"; this.mnuMainFileSave.Click += new System.EventHandler(this.mnuMainFileSave_Click); // + // mnuMainFileSaveAs + // + this.mnuMainFileSaveAs.Name = "mnuMainFileSaveAs"; + this.mnuMainFileSaveAs.ShortcutKeys = ((System.Windows.Forms.Keys)(((System.Windows.Forms.Keys.Control | System.Windows.Forms.Keys.Shift) + | System.Windows.Forms.Keys.S))); + this.mnuMainFileSaveAs.Size = new System.Drawing.Size(242, 26); + this.mnuMainFileSaveAs.Text = "Save &As..."; + this.mnuMainFileSaveAs.Click += new System.EventHandler(this.mnuMainFileSaveAs_Click); + // // toolStripSeparator1 // this.toolStripSeparator1.Name = "toolStripSeparator1"; - this.toolStripSeparator1.Size = new System.Drawing.Size(188, 6); + this.toolStripSeparator1.Size = new System.Drawing.Size(239, 6); // // mnuMainFileExit // this.mnuMainFileExit.Name = "mnuMainFileExit"; this.mnuMainFileExit.ShortcutKeys = ((System.Windows.Forms.Keys)((System.Windows.Forms.Keys.Alt | System.Windows.Forms.Keys.F4))); - this.mnuMainFileExit.Size = new System.Drawing.Size(191, 22); + this.mnuMainFileExit.Size = new System.Drawing.Size(242, 26); this.mnuMainFileExit.Text = "&Exit"; this.mnuMainFileExit.Click += new System.EventHandler(this.mnuMainFileExit_Click); // @@ -131,13 +147,13 @@ private void InitializeComponent() this.mnuMainHelp.DropDownItems.AddRange(new System.Windows.Forms.ToolStripItem[] { this.mnuMainHelpAbout}); this.mnuMainHelp.Name = "mnuMainHelp"; - this.mnuMainHelp.Size = new System.Drawing.Size(24, 20); + this.mnuMainHelp.Size = new System.Drawing.Size(30, 24); this.mnuMainHelp.Text = "&?"; // // mnuMainHelpAbout // this.mnuMainHelpAbout.Name = "mnuMainHelpAbout"; - this.mnuMainHelpAbout.Size = new System.Drawing.Size(152, 22); + this.mnuMainHelpAbout.Size = new System.Drawing.Size(133, 26); this.mnuMainHelpAbout.Text = "&About"; this.mnuMainHelpAbout.Click += new System.EventHandler(this.mnuMainHelpAbout_Click); // @@ -145,7 +161,8 @@ private void InitializeComponent() // this.sptMain.Dock = System.Windows.Forms.DockStyle.Fill; this.sptMain.FixedPanel = System.Windows.Forms.FixedPanel.Panel1; - this.sptMain.Location = new System.Drawing.Point(0, 24); + this.sptMain.Location = new System.Drawing.Point(0, 28); + this.sptMain.Margin = new System.Windows.Forms.Padding(4); this.sptMain.Name = "sptMain"; // // sptMain.Panel1 @@ -155,8 +172,9 @@ private void InitializeComponent() // sptMain.Panel2 // this.sptMain.Panel2.Controls.Add(this.grpRelocation); - this.sptMain.Size = new System.Drawing.Size(796, 416); - this.sptMain.SplitterDistance = 228; + this.sptMain.Size = new System.Drawing.Size(1221, 515); + this.sptMain.SplitterDistance = 397; + this.sptMain.SplitterWidth = 5; this.sptMain.TabIndex = 1; // // grpPage @@ -164,8 +182,10 @@ private void InitializeComponent() this.grpPage.Controls.Add(this.lvPage); this.grpPage.Dock = System.Windows.Forms.DockStyle.Fill; this.grpPage.Location = new System.Drawing.Point(0, 0); + this.grpPage.Margin = new System.Windows.Forms.Padding(4); this.grpPage.Name = "grpPage"; - this.grpPage.Size = new System.Drawing.Size(228, 416); + this.grpPage.Padding = new System.Windows.Forms.Padding(4); + this.grpPage.Size = new System.Drawing.Size(397, 515); this.grpPage.TabIndex = 0; this.grpPage.TabStop = false; this.grpPage.Text = "Page"; @@ -173,6 +193,7 @@ private void InitializeComponent() // lvPage // this.lvPage.Columns.AddRange(new System.Windows.Forms.ColumnHeader[] { + this.colPageVA, this.colPageRVA, this.colBlockSize, this.colCount}); @@ -182,57 +203,64 @@ private void InitializeComponent() this.lvPage.GridLines = true; this.lvPage.HeaderStyle = System.Windows.Forms.ColumnHeaderStyle.Nonclickable; this.lvPage.HideSelection = false; - this.lvPage.Location = new System.Drawing.Point(3, 16); + this.lvPage.Location = new System.Drawing.Point(4, 19); + this.lvPage.Margin = new System.Windows.Forms.Padding(4); this.lvPage.MultiSelect = false; this.lvPage.Name = "lvPage"; - this.lvPage.Size = new System.Drawing.Size(222, 397); + this.lvPage.Size = new System.Drawing.Size(389, 492); this.lvPage.TabIndex = 0; this.lvPage.UseCompatibleStateImageBehavior = false; this.lvPage.View = System.Windows.Forms.View.Details; this.lvPage.SelectedIndexChanged += new System.EventHandler(this.lvPage_SelectedIndexChanged); // + // colPageVA + // + this.colPageVA.Text = "Page VA"; + this.colPageVA.Width = 94; + // // colPageRVA // - this.colPageRVA.Text = "Page RVA"; - this.colPageRVA.Width = 75; + this.colPageRVA.Text = "RVA"; + this.colPageRVA.Width = 81; // // colBlockSize // this.colBlockSize.Text = "Block Size"; - this.colBlockSize.Width = 75; + this.colBlockSize.Width = 94; // // colCount // this.colCount.Text = "# items"; - this.colCount.Width = 50; + this.colCount.Width = 82; // // cmnuPages // + this.cmnuPages.ImageScalingSize = new System.Drawing.Size(20, 20); this.cmnuPages.Items.AddRange(new System.Windows.Forms.ToolStripItem[] { this.cmnuPagesAdd, this.toolStripSeparator3, this.cmnuPagesDelete}); this.cmnuPages.Name = "cmnuPages"; - this.cmnuPages.Size = new System.Drawing.Size(173, 54); + this.cmnuPages.Size = new System.Drawing.Size(188, 58); // // cmnuPagesAdd // this.cmnuPagesAdd.Name = "cmnuPagesAdd"; this.cmnuPagesAdd.ShortcutKeys = System.Windows.Forms.Keys.Insert; - this.cmnuPagesAdd.Size = new System.Drawing.Size(172, 22); + this.cmnuPagesAdd.Size = new System.Drawing.Size(187, 24); this.cmnuPagesAdd.Text = "&Add"; this.cmnuPagesAdd.Click += new System.EventHandler(this.mnuAdd_Click); // // toolStripSeparator3 // this.toolStripSeparator3.Name = "toolStripSeparator3"; - this.toolStripSeparator3.Size = new System.Drawing.Size(169, 6); + this.toolStripSeparator3.Size = new System.Drawing.Size(184, 6); // // cmnuPagesDelete // this.cmnuPagesDelete.Name = "cmnuPagesDelete"; this.cmnuPagesDelete.ShortcutKeys = ((System.Windows.Forms.Keys)((System.Windows.Forms.Keys.Control | System.Windows.Forms.Keys.Delete))); - this.cmnuPagesDelete.Size = new System.Drawing.Size(172, 22); + this.cmnuPagesDelete.Size = new System.Drawing.Size(187, 24); this.cmnuPagesDelete.Text = "&Delete"; this.cmnuPagesDelete.Click += new System.EventHandler(this.cmnuPagesDelete_Click); // @@ -241,8 +269,10 @@ private void InitializeComponent() this.grpRelocation.Controls.Add(this.lvRelocation); this.grpRelocation.Dock = System.Windows.Forms.DockStyle.Fill; this.grpRelocation.Location = new System.Drawing.Point(0, 0); + this.grpRelocation.Margin = new System.Windows.Forms.Padding(4); this.grpRelocation.Name = "grpRelocation"; - this.grpRelocation.Size = new System.Drawing.Size(564, 416); + this.grpRelocation.Padding = new System.Windows.Forms.Padding(4); + this.grpRelocation.Size = new System.Drawing.Size(819, 515); this.grpRelocation.TabIndex = 0; this.grpRelocation.TabStop = false; this.grpRelocation.Text = "Relocation"; @@ -250,7 +280,10 @@ private void InitializeComponent() // lvRelocation // this.lvRelocation.Columns.AddRange(new System.Windows.Forms.ColumnHeader[] { + this.colOffsetVA, + this.colItemRaw, this.colOffset, + this.colOffsetRVA, this.colType}); this.lvRelocation.ContextMenuStrip = this.cmnuRelocations; this.lvRelocation.Dock = System.Windows.Forms.DockStyle.Fill; @@ -258,40 +291,57 @@ private void InitializeComponent() this.lvRelocation.GridLines = true; this.lvRelocation.HeaderStyle = System.Windows.Forms.ColumnHeaderStyle.Nonclickable; this.lvRelocation.HideSelection = false; - this.lvRelocation.Location = new System.Drawing.Point(3, 16); + this.lvRelocation.Location = new System.Drawing.Point(4, 19); + this.lvRelocation.Margin = new System.Windows.Forms.Padding(4); this.lvRelocation.MultiSelect = false; this.lvRelocation.Name = "lvRelocation"; - this.lvRelocation.Size = new System.Drawing.Size(558, 397); + this.lvRelocation.Size = new System.Drawing.Size(811, 492); this.lvRelocation.Sorting = System.Windows.Forms.SortOrder.Ascending; this.lvRelocation.TabIndex = 0; this.lvRelocation.UseCompatibleStateImageBehavior = false; this.lvRelocation.View = System.Windows.Forms.View.Details; // + // colOffsetVA + // + this.colOffsetVA.Text = "Offset VA"; + this.colOffsetVA.Width = 109; + // + // colItemRaw + // + this.colItemRaw.Text = "Item Raw"; + this.colItemRaw.Width = 108; + // // colOffset // this.colOffset.Text = "Offset"; - this.colOffset.Width = 70; + this.colOffset.Width = 102; + // + // colOffsetRVA + // + this.colOffsetRVA.Text = "RVA"; + this.colOffsetRVA.Width = 109; // // colType // this.colType.Text = "Type"; - this.colType.Width = 220; + this.colType.Width = 344; // // cmnuRelocations // + this.cmnuRelocations.ImageScalingSize = new System.Drawing.Size(20, 20); this.cmnuRelocations.Items.AddRange(new System.Windows.Forms.ToolStripItem[] { this.cmnuRelocationsAdd, this.cmnuRelocationsEdit, this.toolStripSeparator2, this.cmnuRelocationsDelete}); this.cmnuRelocations.Name = "cmnuRelocations"; - this.cmnuRelocations.Size = new System.Drawing.Size(153, 98); + this.cmnuRelocations.Size = new System.Drawing.Size(155, 82); // // cmnuRelocationsAdd // this.cmnuRelocationsAdd.Name = "cmnuRelocationsAdd"; this.cmnuRelocationsAdd.ShortcutKeys = System.Windows.Forms.Keys.Insert; - this.cmnuRelocationsAdd.Size = new System.Drawing.Size(152, 22); + this.cmnuRelocationsAdd.Size = new System.Drawing.Size(154, 24); this.cmnuRelocationsAdd.Text = "&Add"; this.cmnuRelocationsAdd.Click += new System.EventHandler(this.mnuAdd_Click); // @@ -299,70 +349,78 @@ private void InitializeComponent() // this.cmnuRelocationsEdit.Name = "cmnuRelocationsEdit"; this.cmnuRelocationsEdit.ShortcutKeys = System.Windows.Forms.Keys.F2; - this.cmnuRelocationsEdit.Size = new System.Drawing.Size(152, 22); + this.cmnuRelocationsEdit.Size = new System.Drawing.Size(154, 24); this.cmnuRelocationsEdit.Text = "&Edit"; this.cmnuRelocationsEdit.Click += new System.EventHandler(this.mnuRelocationsEdit_Click); // // toolStripSeparator2 // this.toolStripSeparator2.Name = "toolStripSeparator2"; - this.toolStripSeparator2.Size = new System.Drawing.Size(149, 6); + this.toolStripSeparator2.Size = new System.Drawing.Size(151, 6); // // cmnuRelocationsDelete // this.cmnuRelocationsDelete.Name = "cmnuRelocationsDelete"; this.cmnuRelocationsDelete.ShortcutKeys = System.Windows.Forms.Keys.Delete; - this.cmnuRelocationsDelete.Size = new System.Drawing.Size(152, 22); + this.cmnuRelocationsDelete.Size = new System.Drawing.Size(154, 24); this.cmnuRelocationsDelete.Text = "&Delete"; this.cmnuRelocationsDelete.Click += new System.EventHandler(this.cmuRelocationsDelete_Click); // // staInfo // + this.staInfo.ImageScalingSize = new System.Drawing.Size(20, 20); this.staInfo.Items.AddRange(new System.Windows.Forms.ToolStripItem[] { + this.staLblImageBase, + this.staLblVirtualAddress, this.staLblCurrentSize, this.staLblMaxSize, this.staPbSize}); - this.staInfo.Location = new System.Drawing.Point(0, 440); + this.staInfo.Location = new System.Drawing.Point(0, 543); this.staInfo.Name = "staInfo"; - this.staInfo.Size = new System.Drawing.Size(796, 22); + this.staInfo.Padding = new System.Windows.Forms.Padding(1, 0, 19, 0); + this.staInfo.Size = new System.Drawing.Size(1221, 26); this.staInfo.TabIndex = 1; this.staInfo.Text = "statusStrip1"; // + // staLblImageBase + // + this.staLblImageBase.Name = "staLblImageBase"; + this.staLblImageBase.Size = new System.Drawing.Size(89, 20); + this.staLblImageBase.Text = "Image base:"; + // + // staLblVirtualAddress + // + this.staLblVirtualAddress.Name = "staLblVirtualAddress"; + this.staLblVirtualAddress.Size = new System.Drawing.Size(110, 20); + this.staLblVirtualAddress.Text = "Virtual address:"; + // // staLblCurrentSize // this.staLblCurrentSize.Name = "staLblCurrentSize"; - this.staLblCurrentSize.Size = new System.Drawing.Size(72, 17); + this.staLblCurrentSize.Size = new System.Drawing.Size(89, 20); this.staLblCurrentSize.Text = "Current size:"; // // staLblMaxSize // this.staLblMaxSize.Name = "staLblMaxSize"; - this.staLblMaxSize.Size = new System.Drawing.Size(54, 17); + this.staLblMaxSize.Size = new System.Drawing.Size(69, 20); this.staLblMaxSize.Text = "Max size:"; // // staPbSize // this.staPbSize.Name = "staPbSize"; - this.staPbSize.Size = new System.Drawing.Size(100, 16); - // - // mnuMainFileSaveAs - // - this.mnuMainFileSaveAs.Name = "mnuMainFileSaveAs"; - this.mnuMainFileSaveAs.ShortcutKeys = ((System.Windows.Forms.Keys)(((System.Windows.Forms.Keys.Control | System.Windows.Forms.Keys.Shift) - | System.Windows.Forms.Keys.S))); - this.mnuMainFileSaveAs.Size = new System.Drawing.Size(191, 22); - this.mnuMainFileSaveAs.Text = "Save &As..."; - this.mnuMainFileSaveAs.Click += new System.EventHandler(this.mnuMainFileSaveAs_Click); + this.staPbSize.Size = new System.Drawing.Size(133, 18); // // frmMain // - this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F); + this.AutoScaleDimensions = new System.Drawing.SizeF(8F, 16F); this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; - this.ClientSize = new System.Drawing.Size(796, 462); + this.ClientSize = new System.Drawing.Size(1221, 569); this.Controls.Add(this.sptMain); this.Controls.Add(this.mnuMain); this.Controls.Add(this.staInfo); this.MainMenuStrip = this.mnuMain; + this.Margin = new System.Windows.Forms.Padding(4); this.Name = "frmMain"; this.StartPosition = System.Windows.Forms.FormStartPosition.CenterScreen; this.Text = "Relocation Section Editor"; @@ -396,9 +454,9 @@ private void InitializeComponent() private System.Windows.Forms.ListView lvRelocation; private System.Windows.Forms.ToolStripMenuItem mnuMainHelp; private System.Windows.Forms.ToolStripMenuItem mnuMainHelpAbout; - private System.Windows.Forms.ColumnHeader colPageRVA; + private System.Windows.Forms.ColumnHeader colPageVA; private System.Windows.Forms.ColumnHeader colBlockSize; - private System.Windows.Forms.ColumnHeader colOffset; + private System.Windows.Forms.ColumnHeader colOffsetVA; private System.Windows.Forms.ColumnHeader colType; private System.Windows.Forms.ToolStripMenuItem mnuMainFileOpen; private System.Windows.Forms.ToolStripSeparator toolStripSeparator1; @@ -420,6 +478,12 @@ private void InitializeComponent() private System.Windows.Forms.ToolStripMenuItem mnuMainFileSave; private System.Windows.Forms.ToolStripMenuItem mnuMainFileSaveAs; private System.Windows.Forms.SaveFileDialog dlgSave; + private System.Windows.Forms.ColumnHeader colOffsetRVA; + private System.Windows.Forms.ToolStripStatusLabel staLblImageBase; + private System.Windows.Forms.ToolStripStatusLabel staLblVirtualAddress; + private System.Windows.Forms.ColumnHeader colPageRVA; + private System.Windows.Forms.ColumnHeader colItemRaw; + private System.Windows.Forms.ColumnHeader colOffset; } } diff --git a/Relocation Section Editor/frmMain.cs b/Relocation Section Editor/frmMain.cs index d5ed908..91e10cc 100644 --- a/Relocation Section Editor/frmMain.cs +++ b/Relocation Section Editor/frmMain.cs @@ -6,6 +6,8 @@ using System.Text; using System.Windows.Forms; using System.IO; +using System.Runtime.InteropServices; +using System.Diagnostics; namespace Relocation_Section_Editor { @@ -13,7 +15,7 @@ public partial class frmMain : Form { private Relocations rel = null; private int pageIndex = 0; - private uint baseAddress = 0; + private UInt64 baseAddress = 0; private string argPath = ""; public frmMain(string[] args) @@ -31,7 +33,7 @@ private void mnuMainFileExit_Click(object sender, EventArgs e) private void mnuMainHelpAbout_Click(object sender, EventArgs e) { - MessageBox.Show("This program has been coded by gta126"); + MessageBox.Show("This program has been coded by gta126", "Info", MessageBoxButtons.OK, MessageBoxIcon.Information); } private void mnuMainFileOpen_Click(object sender, EventArgs e) @@ -81,28 +83,11 @@ private void mnuMainFileOpen_Click(object sender, EventArgs e) } catch (FileNotFoundException) { - MessageBox.Show("File not found"); + MessageBox.Show("File not found", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); } catch (InvalidOperationException ex) { - switch (ex.Message) - { - case "MZ": - MessageBox.Show("MZ Header not found"); - break; - case "PE": - MessageBox.Show("PE Header not found"); - break; - case "X86": - MessageBox.Show("Is not a 32bits executable"); - break; - case "RAW": - MessageBox.Show("No relocation table in this file"); - break; - default: - MessageBox.Show("Unknown error"); - break; - } + MessageBox.Show(ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); } } @@ -113,7 +98,7 @@ private void lvPage_SelectedIndexChanged(object sender, EventArgs e) lvRelocation.Items.Clear(); - uint address = (uint)lvPage.SelectedItems[0].Tag; + UInt64 address = (UInt64)lvPage.SelectedItems[0].Tag; baseAddress = address; pageIndex = lvPage.SelectedItems[0].Index; @@ -121,14 +106,19 @@ private void lvPage_SelectedIndexChanged(object sender, EventArgs e) if (!rel.TryGetRelocs(address, out relocs)) return; + UInt64 itemBase = baseAddress - rel.GetImageBase(); + foreach (Relocations.Reloc reloc in relocs) { ListViewItem item; - if (reloc.type == Relocations.BASE_RELOCATION_TYPE.ABSOLUTE) + if (reloc.type == PeHeader.BASE_RELOCATION_TYPE.IMAGE_REL_BASED_ABSOLUTE) item = new ListViewItem("0x" + reloc.offset.ToString("X8")); else item = new ListViewItem("0x" + (address + reloc.offset).ToString("X8")); + item.SubItems.Add((rel.GetRawAddress() + reloc.offset).ToString("X8")); + item.SubItems.Add(reloc.offset.ToString("X8")); + item.SubItems.Add((itemBase + reloc.offset).ToString("X4")); item.SubItems.Add(reloc.type.ToString()); item.Tag = reloc; @@ -159,6 +149,7 @@ private void RefreshData() foreach (Relocations.Page page in rel.GetPages()) { ListViewItem item = new ListViewItem("0x" + page.address.ToString("X8")); + item.SubItems.Add("0x" + (page.address - rel.GetImageBase()).ToString("X8")); item.SubItems.Add("0x" + page.size.ToString("X8")); item.SubItems.Add(page.count.ToString()); item.Tag = page.address; @@ -176,12 +167,14 @@ private void RefreshData() private void RefreshSize() { - staLblCurrentSize.Text = "Current size: 0x" + rel.GetVirtuallSize().ToString("X8"); + staLblCurrentSize.Text = "Current size: 0x" + rel.GetVirtualSize().ToString("X8"); staLblMaxSize.Text = "Max size: 0x" + rel.GetRawSize().ToString("X8"); + staLblImageBase.Text = "Image base: 0x" + rel.GetImageBase().ToString("X8"); + staLblVirtualAddress.Text = "Virtual address: 0x" + rel.GetVirtualAddress().ToString("X8"); staPbSize.Minimum = 0; staPbSize.Maximum = (int)rel.GetRawSize(); - staPbSize.Value = (int)rel.GetVirtuallSize(); + staPbSize.Value = (int)rel.GetVirtualSize(); } private void frmMain_Load(object sender, EventArgs e) @@ -227,17 +220,17 @@ private void mnuAdd_Click(object sender, EventArgs e) switch (code) { case -1: - MessageBox.Show("This address is already in the relocation table"); + MessageBox.Show("This address is already in the relocation table", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); break; case 0: - MessageBox.Show("Cannot add this address (0x" + frm.GetAddress().ToString("X8") + ")"); + MessageBox.Show("Cannot add this address (0x" + frm.GetAddress().ToString("X8") + ")", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); break; case 1: case 2: RefreshData(); break; default: - MessageBox.Show("Unknown error"); + MessageBox.Show("Unknown error", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); break; } @@ -256,7 +249,7 @@ private void mnuRelocationsEdit_Click(object sender, EventArgs e) if (!rel.EditRelocation(frm.GetOldAddress(), frm.GetNewAddress(), frm.GetRelocType())) { - MessageBox.Show("Cannot edit this address"); + MessageBox.Show("Cannot edit this address", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); return; } @@ -266,7 +259,7 @@ private void mnuRelocationsEdit_Click(object sender, EventArgs e) private void mnuMainFileSave_Click(object sender, EventArgs e) { if (!rel.WriteRelocations()) - MessageBox.Show("File not saved"); + MessageBox.Show("File not saved", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); } private void frmMain_FormClosing(object sender, FormClosingEventArgs e) @@ -338,7 +331,7 @@ private void mnuMainFileSaveAs_Click(object sender, EventArgs e) return; if (!rel.WriteRelocations(dlgSave.FileName)) - MessageBox.Show("File not saved"); + MessageBox.Show("File not saved", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); else this.Text = "Relocation Section Editor - " + rel.GetPath(); }