Windows PE 重定位表编程（枚举重定位地址）

原理之前单独总结过，在这里：

http://blog.csdn.net/u013761036/article/details/54051347

下面是枚举重定位信息的代码：

// ReLocationX86.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <string>
#include <windows.h>
#include <shlwapi.h>
#include <Dbghelp.h> //ImageRvaToVa
#pragma comment(lib, "Dbghelp.lib")
#pragma comment(lib, "shlwapi.lib")
using namespace std;
#pragma warning(disable : 4996)

unsigned char bMemory[1024*1024*5] = {0};

DWORD dwLoadPE2Memory(string strPePath){
FILE *fpLoadDll;
char cCache[1024];
if((fpLoadDll = fopen(strPePath.c_str(),"rb")) == NULL) {
return 0;
}
DWORD dwNowReadId = 0;
while (1) {
ZeroMemory(cCache ,sizeof(cCache));
DWORD dwReadSize = fread(cCache,1,1024 ,fpLoadDll);
DWORD dwErrorCode = GetLastError();
if(dwReadSize == 0){
break;
}
for(int i = 1 ;i <= dwReadSize ;i ++){
bMemory[dwNowReadId++] = cCache[i-1];
}
}
fclose(fpLoadDll);
return dwNowReadId;
}

void DoReLocation( void * pBaseAddress){

PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pBaseAddress;
PIMAGE_NT_HEADERS pNtHeaders = (PIMAGE_NT_HEADERS)((PBYTE)pBaseAddress + pDosHeader->e_lfanew);
    //PIMAGE_BASE_RELOCATION pNowPageAddress = (PIMAGE_BASE_RELOCATION)((unsigned long)pBaseAddress +  pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);
if(pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress == 0){
return ;
}
PIMAGE_BASE_RELOCATION pNowPageAddress = (PIMAGE_BASE_RELOCATION)ImageRvaToVa(
pNtHeaders,    pBaseAddress,
pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress,
NULL);

    while ((pNowPageAddress->VirtualAddress + pNowPageAddress->SizeOfBlock) != 0) {
        WORD *pLocalListAddress = (WORD *)((PBYTE)pNowPageAddress + sizeof(IMAGE_BASE_RELOCATION));
        int nNumberOfReloc = (pNowPageAddress->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION))/sizeof(WORD);
        for ( int i=0 ; i < nNumberOfReloc; i++){
            if ((DWORD)(pLocalListAddress[i] & 0x0000F000) == 0x00003000){

                DWORD* pNeedReLocationAddress = (DWORD *)((PBYTE)pBaseAddress + pNowPageAddress->VirtualAddress + (pLocalListAddress[i] & 0x0FFF));
                DWORD dwDelta = (DWORD)pBaseAddress - pNtHeaders->OptionalHeader.ImageBase;
                *pLocalListAddress += dwDelta;

DWORD dwSorAddress ,dwNewAddress ,dwImageBaseAddress ,dwVirtualBaseAddress;
dwSorAddress = *pLocalListAddress - dwDelta;
                dwNewAddress = *pLocalListAddress;
dwImageBaseAddress = pNtHeaders->OptionalHeader.ImageBase;
dwVirtualBaseAddress = (DWORD)pBaseAddress;
printf("ImageBasAd:%X ,VirtualBasAd:%X ,SorAd:%X ,NewAd:%X\n" ,dwImageBaseAddress ,dwVirtualBaseAddress ,dwSorAddress ,dwNewAddress);
            }
        }
        pNowPageAddress = (PIMAGE_BASE_RELOCATION)((PBYTE)pNowPageAddress + pNowPageAddress->SizeOfBlock);
    }
}

int _tmain(int argc, _TCHAR* argv[])
{
//HMODULE hModule = GetModuleHandle(NULL);
if(dwLoadPE2Memory("C:\\TTT.exe")){
DoReLocation(bMemory);
}
return 0;
}