6

Now working on binary analysis of PE and stuck on tricky (for me), ungoogleable question.

For instance, I've binary, that needs to be patched. So after doing that will be awesome, if there is way to insert address of my function to relocation table. The following picture can illustrate thing I'm talking about.

Relocated functions in binary

So, as you can see, relocated functions marked pale, and my function is not in the relocation table. What should I patch to add my function into relocation table? Tried CFF Explorer with no luck. All the patches was made in hiew.

see ya
  • 823
  • 2
  • 8
  • 20
  • If you managed to solve the question, then just post an answer below and mark it as the answer. Also it would be helpful to type the actual names for tools to facilitate search. – Dmitry Janushkevich Jul 02 '14 at 11:54

1 Answers1

7

Issue solved. For that moment tested several utilities for relocation patching.

RelocEditor - didn't solve the issue, but maybe for some future researchers who will face with similar task will find it useful

Reloc Rebuilder - actually solved issue. Just select patched executable and app should fix the relocation table.

Relocation Section Editor - didn't tried myself, but should also work. Link here because of purposes as in first item.

see ya
  • 823
  • 2
  • 8
  • 20