load file as PE-loader

[Dimarik__]

RVA or Relative Virtual Address is a memory offset from an unknown base. Generally it is added to the load address of the PE resulting in the actual virtual memory address of a particular peice of data. For example the first entry in the DATA section might have an RVA of 0x1000, if the PE is loaded at 0x400000, the actual VA (Virtual Address) is 0x401000. It is a method of allowing each section to be relocated in memory without have too much to fix up by the PE loader. The file offset is simply the number of bytes from the beginning of the file.

Thank you very much.

[Vortex]

Hi Dimarik,

Here is a project to create a simple PE loader :

Loading and running EXEs and DLLs from memory

[Dimarik__]

Hi Dimarik,

Here is a project to create a simple PE loader :

Loading and running EXEs and DLLs from memory

Thank you for the reference.

[dedndave]

Erol always has nice stuff   :bg
check out his site for some great tools
http://www.vortex.masmcode.com/

[Dimarik__]

I found some interesting about linkers and loaders and I'm going to read this. If you want you can view this article. I uploaded it here http://zalil.ru/32821967

[vanjast]

looks interesting..  :U

[Dimarik__]

looks interesting..  :U

When I was searcing this information, I wanted to find algorithm where describes, how Windows loads PE-file into the memory. But... I understood that Vortex's theme and his code is more useful for me that my article. Thank you))) I'll study this information by your code=)

[Dimarik__]

Hi Dimarik,

Here is a project to create a simple PE loader :

Loading and running EXEs and DLLs from memory

Thank you for code. It is the best material which I've ever seen by this theme.
But I didn't understand one comment in your code:

Code Select Expand

mov   [ecx+eax*4], edi                  ;<----- Save API address at IAT
It's in the file import.asm
Please, explain, what is the IAT?

[dedndave]

Import Address Table

typically, when the OS loads an exe, the functions called are referenced in the IAT
the OS fills in the addresses of the actual code

it might looks something like this before it is loaded

Code Select Expand

00401DB4: FF2534234000 jmp dword[00402334 ->00002398 GetStdHandle] ;call kernel32.GetStdHandle
00401DBA: FF2540234000 jmp dword[00402340 ->000023C2 ExitProcess]  ;call kernel32.ExitProcess
00401DC0: FF2544234000 jmp dword[00402344 ->000023D0 ReadFile]     ;call kernel32.ReadFile
00401DC6: FF2548234000 jmp dword[00402348 ->000023DC CloseHandle]  ;call kernel32.CloseHandle
00401DCC: FF2574234000 jmp dword[00402374 ->00002494 WriteFile]    ;call kernel32.WriteFile

when your program calls a function, it actually calls a jmp in the IAT

sometimes, a program may use LoadModule and GetProcAddress to get the address of a function
in such cases, a "fake" entry can be made in the code or data section to emulate the IAT

here is a simple example by Erol (Vortex)
http://www.masm32.com/board/index.php?topic=11772.msg89003#msg89003

[Dimarik__]

I read this article and saw that the autor had recommended to read one article.

I highly recommend reading Russell Osterlund's article in this issue which describes the steps that the Windows loader takes.

Can you tell me where I can find this article or where I can find similar article?

[dedndave]

http://www.smidgeonsoft.prohosting.com/

http://www.smidgeonsoft.prohosting.com/documentation.html

I highly recommend reading Russell Osterlund's article in this issue which describes the steps that the Windows loader takes.

where did you see that reference ?

here we go - try this...
http://msdn.microsoft.com/en-us/magazine/cc301727.aspx

[Dimarik__]

http://www.smidgeonsoft.prohosting.com/

http://www.smidgeonsoft.prohosting.com/documentation.html

I highly recommend reading Russell Osterlund's article in this issue which describes the steps that the Windows loader takes.

where did you see that reference ?

here we go - try this...
http://msdn.microsoft.com/en-us/magazine/cc301727.aspx

I saw it here http://msdn.microsoft.com/en-us/magazine/cc301808.aspx