Windows APT Warfare

6

PE Module Relocation

In the previous chapters, we have built a solid foundation in programming, starting with compiling C/C++ source code, generating static program files, verifying dynamic memory distribution, and executing programs directly in memory. In this chapter, we will learn about the relocation design of PE modules. We will learn how to manually analyze a PE binary and implement dynamic PE module relocation, allowing any program to be loaded into memory.

In this chapter, we’re going to cover the following main topics:

• Relocation table of PE
• tinyLoader example

Relocation table of PE

In the previous chapters, we assumed that executable files must be mounted on the image base expected by the compiler. However, in the following cases, ...