From fef80b544b74e8f0a58a3c6cb4828caf3a03ff06 Mon Sep 17 00:00:00 2001 From: Simon Rozman Date: Sat, 7 Nov 2020 20:58:15 +0100 Subject: [PATCH 1/7] Add ARM and ARM64 platforms Signed-off-by: Simon Rozman --- MemoryModule.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/MemoryModule.c b/MemoryModule.c index 9f95a70..0c5d209 100644 --- a/MemoryModule.c +++ b/MemoryModule.c @@ -54,10 +54,16 @@ #define IMAGE_SIZEOF_BASE_RELOCATION (sizeof(IMAGE_BASE_RELOCATION)) #endif -#ifdef _WIN64 +#if defined(_M_IX86) +#define HOST_MACHINE IMAGE_FILE_MACHINE_I386 +#elif defined(_M_AMD64) #define HOST_MACHINE IMAGE_FILE_MACHINE_AMD64 +#elif defined(_M_ARM) +#define HOST_MACHINE IMAGE_FILE_MACHINE_ARMNT +#elif defined(_M_ARM64) +#define HOST_MACHINE IMAGE_FILE_MACHINE_ARM64 #else -#define HOST_MACHINE IMAGE_FILE_MACHINE_I386 +#error Unsupported architecture #endif #include "MemoryModule.h" From acd7da679a10ee337856b34ca4da6532814237d9 Mon Sep 17 00:00:00 2001 From: Simon Rozman Date: Sat, 7 Nov 2020 21:02:14 +0100 Subject: [PATCH 2/7] Fix DEBUG_OUTPUT Signed-off-by: Simon Rozman --- MemoryModule.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/MemoryModule.c b/MemoryModule.c index 0c5d209..96a0fcb 100644 --- a/MemoryModule.c +++ b/MemoryModule.c @@ -141,13 +141,12 @@ OutputLastError(const char *msg) #ifndef DEBUG_OUTPUT UNREFERENCED_PARAMETER(msg); #else - LPVOID tmp; - char *tmpmsg; - FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, - NULL, GetLastError(), MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)&tmp, 0, NULL); + char *tmp, *tmpmsg; + FormatMessageA(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, + NULL, GetLastError(), MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPSTR)&tmp, 0, NULL); tmpmsg = (char *)LocalAlloc(LPTR, strlen(msg) + strlen(tmp) + 3); sprintf(tmpmsg, "%s: %s", msg, tmp); - OutputDebugString(tmpmsg); + OutputDebugStringA(tmpmsg); LocalFree(tmpmsg); LocalFree(tmp); #endif From fdf41455e93ce08f3f93f9b6caf724347f9209d3 Mon Sep 17 00:00:00 2001 From: Simon Rozman Date: Sat, 7 Nov 2020 21:04:48 +0100 Subject: [PATCH 3/7] Allow IMAGE_REL_BASED_DIR64 relocation on all platforms Signed-off-by: Simon Rozman --- MemoryModule.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/MemoryModule.c b/MemoryModule.c index 96a0fcb..72144f6 100644 --- a/MemoryModule.c +++ b/MemoryModule.c @@ -419,14 +419,12 @@ PerformBaseRelocation(PMEMORYMODULE module, ptrdiff_t delta) } break; -#ifdef _WIN64 case IMAGE_REL_BASED_DIR64: { ULONGLONG *patchAddr64 = (ULONGLONG *) (dest + offset); *patchAddr64 += (ULONGLONG) delta; } break; -#endif default: //printf("Unknown relocation: %d\n", type); From 0a984057dab03fae746aaf6fb380ccbbc87ed223 Mon Sep 17 00:00:00 2001 From: Simon Rozman Date: Sat, 7 Nov 2020 21:05:41 +0100 Subject: [PATCH 4/7] Implement IMAGE_REL_BASED_LOW relocation Signed-off-by: Simon Rozman --- MemoryModule.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/MemoryModule.c b/MemoryModule.c index 72144f6..f3abda5 100644 --- a/MemoryModule.c +++ b/MemoryModule.c @@ -411,6 +411,10 @@ PerformBaseRelocation(PMEMORYMODULE module, ptrdiff_t delta) // skip relocation break; + case IMAGE_REL_BASED_LOW: + *(WORD *)(dest + offset) += LOWORD(delta); + break; + case IMAGE_REL_BASED_HIGHLOW: // change complete 32 bit address { From 5e850c0b76d0d7a686aa8f85e1e10aa893f3a3f2 Mon Sep 17 00:00:00 2001 From: Simon Rozman Date: Sat, 7 Nov 2020 21:06:15 +0100 Subject: [PATCH 5/7] Implement IMAGE_REL_BASED_THUMB_MOV32 relocation Signed-off-by: Simon Rozman --- MemoryModule.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/MemoryModule.c b/MemoryModule.c index f3abda5..f4cf586 100644 --- a/MemoryModule.c +++ b/MemoryModule.c @@ -430,6 +430,44 @@ PerformBaseRelocation(PMEMORYMODULE module, ptrdiff_t delta) } break; + case IMAGE_REL_BASED_THUMB_MOV32: + { + DWORD inst = *(DWORD *)(dest + offset); + DWORD imm16 = ((inst << 1) & 0x0800) + ((inst << 12) & 0xf000) + + ((inst >> 20) & 0x0700) + ((inst >> 16) & 0x00ff); + DWORD hi_delta; + + if ((inst & 0x8000fbf0) != 0x0000f240) + fwprintf(stdout, L"wrong Thumb2 instruction %08x, expected MOVW\n", inst); + + imm16 += LOWORD(delta); + hi_delta = HIWORD(delta) + HIWORD(imm16); + *(DWORD *)(dest + offset) = (inst & 0x8f00fbf0) + ((imm16 >> 1) & 0x0400) + + ((imm16 >> 12) & 0x000f) + + ((imm16 << 20) & 0x70000000) + + ((imm16 << 16) & 0xff0000); + + if (hi_delta != 0) + { + inst = *(DWORD *)(dest + offset + 4); + imm16 = ((inst << 1) & 0x0800) + ((inst << 12) & 0xf000) + + ((inst >> 20) & 0x0700) + ((inst >> 16) & 0x00ff); + + if ((inst & 0x8000fbf0) != 0x0000f2c0) + fwprintf(stdout, L"wrong Thumb2 instruction %08x, expected MOVT\n", inst); + + imm16 += hi_delta; + if (imm16 > 0xffff) + fwprintf(stdout, L"resulting immediate value won't fit: %08x\n", imm16); + *(DWORD *)(dest + offset + 4) = (inst & 0x8f00fbf0) + + ((imm16 >> 1) & 0x0400) + + ((imm16 >> 12) & 0x000f) + + ((imm16 << 20) & 0x70000000) + + ((imm16 << 16) & 0xff0000); + } + } + break; + default: //printf("Unknown relocation: %d\n", type); break; From 08a59f29223e3b0bc930b211a3b6b26223288838 Mon Sep 17 00:00:00 2001 From: Simon Rozman Date: Sat, 7 Nov 2020 21:09:12 +0100 Subject: [PATCH 6/7] Fix loading of DLLs that export all functions by ordinal See-also: https://github.com/fancycode/MemoryModule/pull/96 Signed-off-by: Simon Rozman --- MemoryModule.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MemoryModule.c b/MemoryModule.c index f4cf586..7af164e 100644 --- a/MemoryModule.c +++ b/MemoryModule.c @@ -835,7 +835,7 @@ FARPROC MemoryGetProcAddress(HMEMORYMODULE mod, LPCSTR name) } exports = (PIMAGE_EXPORT_DIRECTORY) (codeBase + directory->VirtualAddress); - if (exports->NumberOfNames == 0 || exports->NumberOfFunctions == 0) { + if (exports->NumberOfFunctions == 0) { // DLL doesn't export anything SetLastError(ERROR_PROC_NOT_FOUND); return NULL; From 47a9ee83dbf08eed89a76a0cf57d275b8f11933b Mon Sep 17 00:00:00 2001 From: HotKeyIt Date: Fri, 15 Mar 2019 01:18:40 +0100 Subject: [PATCH 7/7] Fix SectionAlignment Some dlls do not use Native SectionAlignment, instead use SectionAlignment from PE. --- MemoryModule.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/MemoryModule.c b/MemoryModule.c index 7af164e..cf9f372 100644 --- a/MemoryModule.c +++ b/MemoryModule.c @@ -654,9 +654,8 @@ HMEMORYMODULE MemoryLoadLibraryEx(const void *data, size_t size, } } - GetNativeSystemInfo(&sysInfo); - alignedImageSize = AlignValueUp(old_header->OptionalHeader.SizeOfImage, sysInfo.dwPageSize); - if (alignedImageSize != AlignValueUp(lastSectionEnd, sysInfo.dwPageSize)) { + alignedImageSize = AlignValueUp(old_header->OptionalHeader.SizeOfImage, old_header->OptionalHeader.SectionAlignment); + if (alignedImageSize != AlignValueUp(lastSectionEnd, old_header->OptionalHeader.SectionAlignment)) { SetLastError(ERROR_BAD_EXE_FORMAT); return NULL; }