Implement PE & MDMP base relocations #4711

Roeegg2 · 2024-11-11T14:55:51Z

Your checklist for this pull request

I've read the guidelines for contributing to this repository
I made sure to follow the project's coding style
I've documented or updated the documentation of every function and struct this PR changes. If not so I've explained why.
I've added tests that prove my fix is effective or that my feature works (if possible)
I've updated the rizin book with the relevant information (if needed)

Detailed description

Up until now PE relocations were implemented as imports, which is incorrect. The PE format uses base relocations for image files (ie executable files) and classic COFF relocations for object files.

Implemented so far:

PE base relocation parsing + assigning
PE base relocation tests

Still need to implement:

~~relocation patching~~ - Rizin always loads the binary in it's expected base address, so no patching is needed (I added a detailed comment about this in relocs function in bin_pe.inc)
~~make MDMP use the new base relocation~~ MDMP doesn't have relocations, only imports.
~~add COFF relocations for object files~~ technically PE can have COFF relocations since it's based off of COFF, but COFF relocations are only used for for object files, and there is no reason to use PE for object files, so it's never actually used.

Notes:

There are no names printed with base relocations, since they don't have a symbol/name field associated with them. Simply a type and offset to apply the relocation in.
...

Test plan

All tests green.

...

Closing issues

...

Roeegg2 · 2024-11-11T14:56:06Z

Some things I wasn't sure about:

The comment in has_canary seems to be from r2, and I don't see what leaks might be caused from this...
Should I add licensing to the new created files?
I deliberately didn't add COFF base relocations yet, since we could use the COFF format code for this. There is actually quite a handful of code we could use from COFF plugin instead of completely re implementing it for PE. It might be better to add that to a separate issue & PR since this seems like an issue on its own. This might take a lot of work though since it would require changing a lot of the internal structures used by PE plugin, as well as re implementing handling of many things in COFF to make it compatible with PE as well.

librz/bin/format/pe/pe_relocs.c

librz/bin/format/pe/pe64_relocs.c

librz/bin/format/pe/pe_relocs.c

librz/bin/p/bin_pe.inc

XVilka · 2024-11-11T15:29:24Z

librz/bin/p/bin_pe.inc

@@ -554,30 +638,16 @@ err:
 }

 static int has_canary(RzBinFile *bf) {
-	// XXX: We only need imports here but this causes leaks, we need to wait for the below. This is a horrible solution!
 	// TODO: use O(1) when imports sdbized


Remove this comment too

XVilka · 2024-11-11T15:31:56Z

I deliberately didn't add COFF base relocations yet, since we could use the COFF format code for this. There is actually quite a handful of code we could use from COFF plugin instead of completely re implementing it for PE. It might be better to add that to a separate issue & PR since this seems like an issue on its own. This might take a lot of work though since it would require changing a lot of the internal structures used by PE plugin, as well as re implementing handling of many things in COFF to make it compatible with PE as well.

For now, I think some code duplication is fine. Sharing the code between two plugins is non-trivial at this point.

librz/bin/format/pe/pe_relocs.c

XVilka · 2024-11-12T02:41:03Z

librz/bin/format/pe/pe64_relocs.c

@@ -0,0 +1,4 @@
+// SPDX-FileCopyrightText: 2024 Roee Toledano <[email protected]>
+// SPDX-License-Identifier: LGPL-3.0-only
+#define RZ_BIN_PE64 1


librz/bin/format/pe/pe.h

wargio

This needs to be tested via distro- branch before merge. @XVilka

librz/bin/format/pe/pe_relocs.c

wargio

Please always initialize the variables to 0 or NULL so we can avoid random crashes and weird unintentional behavior.

librz/bin/format/pe/pe.h

Roeegg2 · 2024-11-16T20:04:34Z

Sorry for the ugly commit history. I could rebase interactive + squash with the old ones so it's easier to review.

Roeegg2 · 2024-11-16T20:14:26Z

All tests are green except flagspace tests. Because there is no symbol associated with base relocations, they have no name associated with them, so I'm not sure how we can use flags here

librz/bin/p/bin_pe.inc

librz/bin/format/pe/pe.h

librz/bin/p/bin_pe.inc

XVilka

Good changes, but why did you remove MDMP relocs completely?

librz/bin/format/pe/pe_relocs.c

librz/bin/p/bin_pe.inc

XVilka · 2024-11-20T05:29:51Z

I think it should be in 0.8.0 release, assuming it will be finished in time.

wargio · 2024-11-20T07:11:57Z

Ok, i checked the documentation and saw how other tools shows this, so the changes are ok, just give it a name like pe_<va offset> so rizin can create the flags reloc.pe_<va offset>, when you define the name use rz_str_newf("pe_%08" PFMT64x", offset) (change "offset" to the correct variable holding the vaddr).

please also fix the mdmp relocs that you have removed.

librz/bin/format/mdmp/mdmp_pe.c

wargio · 2024-11-20T15:57:02Z

librz/bin/format/pe/pe.h

+	ut32 page_rva;
+	ut32 block_size;


please give a short description of what these fields are.
Example of formatting

Suggested change

ut32 page_rva;

ut32 block_size;

ut32 page_rva; ///< PE RVA see doc https://bla

ut32 block_size; ///< PE reloc block size for xxxxx

I added a link to the base relocations documentation section of the specification, I will add detailed comments to each struct field too though

librz/bin/format/pe/pe.h

librz/bin/p/bin_pe.inc

MDMP doesn't have any relocations (base or COFF), only contains imports of the dumped executable. Up until now, imports were used which is wrong. * Remove MDMP relocations * Remove MDMP relocations tests

1. Everything is based off of Microsoft's PE format documentation [found here](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format) 2. Up until now, imports were used for relocations in the PE & MDMP format, which is wrong. PE uses base relocations. 3. PE relocations do not have symbols associated with them, and thus have no name. In order to still have flags in relocs flagspace, dummy symbols were allocated with generic names composed of the relocation's virtual address space. * Remove old code of setting import entries to PE relocations * Parse PE base relocations * Implement converting from the specific RzBinPeRelocEnt type to the general RzBinReloc type * Implement corrent type naming of PE relocations * Add missing `PE_IMAGE_FILE_MACHINE` types * Add PE base relocation types * Fix PE format 'has_canary' function * Remove 'RzBinPEObj.endian' and use 'RzBinPEObj.big_endian' instead * Removed a.exe and b.exe tests, as they don't contain base relocations and swapped them with correct tests * Corrected old PE relocation tests * Add new PE base relocation tests

Roeegg2 requested review from ret2libc, wargio, XVilka, kazarmy and thestr4ng3r as code owners November 11, 2024 14:55

github-actions bot added rz-test RzBin PE labels Nov 11, 2024

XVilka requested changes Nov 11, 2024

View reviewed changes

XVilka changed the title ~~Implement PE & MDMP base relocations. DO NOT MERGE YET!~~ [WIP] Implement PE & MDMP base relocations. DO NOT MERGE YET! Nov 11, 2024

Roeegg2 force-pushed the pe-reloc branch 2 times, most recently from 64455b5 to 7cac944 Compare November 11, 2024 16:52

wargio marked this pull request as draft November 12, 2024 02:29

XVilka requested changes Nov 12, 2024

View reviewed changes

wargio requested changes Nov 12, 2024

View reviewed changes

Roeegg2 force-pushed the pe-reloc branch from 7cac944 to b716edf Compare November 12, 2024 17:32

wargio reviewed Nov 13, 2024

View reviewed changes

librz/bin/format/pe/pe_relocs.c Outdated Show resolved Hide resolved

wargio reviewed Nov 13, 2024

View reviewed changes

librz/bin/format/pe/pe_relocs.c Outdated Show resolved Hide resolved

wargio reviewed Nov 13, 2024

View reviewed changes

librz/bin/format/pe/pe_relocs.c Outdated Show resolved Hide resolved

wargio reviewed Nov 13, 2024

View reviewed changes

librz/bin/format/pe/pe_relocs.c Outdated Show resolved Hide resolved

wargio requested changes Nov 13, 2024

View reviewed changes

Roeegg2 force-pushed the pe-reloc branch from b716edf to 0040b1d Compare November 13, 2024 17:36

wargio reviewed Nov 14, 2024

View reviewed changes

librz/bin/format/pe/pe.h Outdated Show resolved Hide resolved

wargio reviewed Nov 17, 2024

View reviewed changes

librz/bin/p/bin_pe.inc Outdated Show resolved Hide resolved

wargio reviewed Nov 17, 2024

View reviewed changes

librz/bin/p/bin_pe.inc Outdated Show resolved Hide resolved

wargio reviewed Nov 17, 2024

View reviewed changes

librz/bin/format/pe/pe.h Show resolved Hide resolved

wargio reviewed Nov 19, 2024

View reviewed changes

librz/bin/p/bin_pe.inc Outdated Show resolved Hide resolved

wargio reviewed Nov 19, 2024

View reviewed changes

librz/bin/p/bin_pe.inc Outdated Show resolved Hide resolved

XVilka requested changes Nov 20, 2024

View reviewed changes

XVilka added this to the 0.8.0 milestone Nov 20, 2024

Roeegg2 force-pushed the pe-reloc branch from f576970 to 3053dab Compare November 20, 2024 14:28

Roeegg2 changed the title ~~[WIP] Implement PE & MDMP base relocations. DO NOT MERGE YET!~~ Implement PE & MDMP base relocations Nov 20, 2024

Roeegg2 marked this pull request as ready for review November 20, 2024 14:30

Roeegg2 force-pushed the pe-reloc branch from 3053dab to 4a468a6 Compare November 20, 2024 14:41

XVilka approved these changes Nov 20, 2024

View reviewed changes

wargio reviewed Nov 20, 2024

View reviewed changes

librz/bin/format/mdmp/mdmp_pe.c Outdated Show resolved Hide resolved

wargio reviewed Nov 20, 2024

View reviewed changes

librz/bin/format/pe/pe.h Outdated Show resolved Hide resolved

wargio reviewed Nov 20, 2024

View reviewed changes

librz/bin/p/bin_pe.inc Outdated Show resolved Hide resolved

Remove MDMP relocations

abca61e

MDMP doesn't have any relocations (base or COFF), only contains imports of the dumped executable. Up until now, imports were used which is wrong. * Remove MDMP relocations * Remove MDMP relocations tests

Roeegg2 force-pushed the pe-reloc branch from 4a468a6 to 36e764c Compare November 20, 2024 16:56

Roeegg2 force-pushed the pe-reloc branch from 36e764c to 97d145e Compare November 20, 2024 18:02

XVilka merged commit 82b119d into rizinorg:dev Nov 21, 2024
45 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement PE & MDMP base relocations #4711

Implement PE & MDMP base relocations #4711

Roeegg2 commented Nov 11, 2024 •

edited

Loading

Roeegg2 commented Nov 11, 2024

XVilka Nov 11, 2024

XVilka commented Nov 11, 2024

XVilka Nov 12, 2024

wargio left a comment

wargio left a comment

Roeegg2 commented Nov 16, 2024

Roeegg2 commented Nov 16, 2024

XVilka left a comment

XVilka commented Nov 20, 2024

wargio commented Nov 20, 2024

wargio Nov 20, 2024

Roeegg2 Nov 20, 2024

Implement PE & MDMP base relocations #4711

Implement PE & MDMP base relocations #4711

Conversation

Roeegg2 commented Nov 11, 2024 • edited Loading

Roeegg2 commented Nov 11, 2024

XVilka Nov 11, 2024

Choose a reason for hiding this comment

XVilka commented Nov 11, 2024

XVilka Nov 12, 2024

Choose a reason for hiding this comment

wargio left a comment

Choose a reason for hiding this comment

wargio left a comment

Choose a reason for hiding this comment

Roeegg2 commented Nov 16, 2024

Roeegg2 commented Nov 16, 2024

XVilka left a comment

Choose a reason for hiding this comment

XVilka commented Nov 20, 2024

wargio commented Nov 20, 2024

wargio Nov 20, 2024

Choose a reason for hiding this comment

Roeegg2 Nov 20, 2024

Choose a reason for hiding this comment

Roeegg2 commented Nov 11, 2024 •

edited

Loading