基址重定位

// BRL.cpp : 输出基址重定位信息
//

#include "stdafx.h"
#include <windows.h>


DWORD RVA2Offset( PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA )
{
    PIMAGE_SECTION_HEADER pSection = ( PIMAGE_SECTION_HEADER )( ( DWORD )pNTHeader + sizeof( IMAGE_NT_HEADERS ) );
    
    for ( int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++ )
    {
        if ( dwRVA >= pSection[i].VirtualAddress && dwRVA < ( pSection[i].VirtualAddress + pSection[i].SizeOfRawData ) )
        {
            return pSection[i].PointerToRawData + ( dwRVA - pSection[i].VirtualAddress );
        }
    }
    
    return 0;
}

int _tmain( int argc, _TCHAR* argv[] )
{
    HANDLE hFile = INVALID_HANDLE_VALUE;
    HANDLE hMapping = NULL;
    PVOID pbFile = NULL;
    __try
    {
        TCHAR sExePath[MAX_PATH] = {0};
        _getts_s( sExePath );
        hFile = CreateFile( sExePath, GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL );
        hMapping = CreateFileMapping( hFile, NULL, PAGE_READWRITE, 0, 0, NULL );
        pbFile = MapViewOfFile( hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0 );
        
        if ( INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile )
        {
            printf( "创建内存映射文件失败\r\n" );
            return -1;
        }
        
        PIMAGE_DOS_HEADER pDosHeader = ( PIMAGE_DOS_HEADER )pbFile;
        PIMAGE_NT_HEADERS pNTHeader = ( PIMAGE_NT_HEADERS )( ( DWORD )pbFile + pDosHeader->e_lfanew );
        
        if ( 0x00004550 != pNTHeader->Signature )
        {
            printf( "不是有效的PE文件\r\n" );
            return -1;
        }
        
        DWORD dwRelocOffset = RVA2Offset( pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress );
        PIMAGE_BASE_RELOCATION pReloc = ( PIMAGE_BASE_RELOCATION )( ( DWORD )pbFile + dwRelocOffset );
        
        if ( 0 == pReloc->VirtualAddress )
        {
            printf( "没有重定位表\r\n" );
            return -1;
        }
        
        while ( pReloc->VirtualAddress )
        {
            printf( "重定位地址:[0x%08X]\r\n", pReloc->VirtualAddress );
            
            for ( DWORD i = 0; i < ( pReloc->SizeOfBlock - sizeof( IMAGE_BASE_RELOCATION ) ) / 2; i++ )
            {
                printf( "   <%04d> - 0x%08X\n", i, pReloc->VirtualAddress + ( ( *( WORD* )( ( DWORD )pReloc + sizeof( IMAGE_BASE_RELOCATION ) + i * 2 ) ) & 0x0FFF ) );
            }
            pReloc = ( PIMAGE_BASE_RELOCATION )( ( DWORD )pReloc + pReloc->SizeOfBlock );
        }
        return 0;
    }
    __finally
    {
        if ( NULL != pbFile )
        {
            UnmapViewOfFile( pbFile );
        }
        
        if ( NULL != hMapping )
        {
            CloseHandle( hMapping );
        }
        
        if ( INVALID_HANDLE_VALUE != hFile )
        {
            CloseHandle( hFile );
        }
    }
}