So in this video, we are going to fix the base relocations.
So before, uh, let's quickly discuss about this base relocations.
Suppose you have a program that contains some pointers.
So let's say eight is equals to ten and there is a pointer.
Pointing to this address of this variable, let's say a value is at 2000 hexadecimal and also image
based address is 5000.
So that means this pointer will point it to the address of this variable that is from the base address
to this 2000 hit offset.
That is 7000 hit job offset.
Now, whenever we run the program, this image base just may change because there may be some other
module at this address.
Then this image address is going to be changed for the entire executable and then this pointer value
become invalid.
So let's say a new image based address is 15,000 hits and then this address becomes invalid.
So what you need to do is you need to find the difference between the loaded new image based address
and the preferred based on this.
So the preferred base set is 5000 and the new Reloaded based address is 15,000.
So if we go and subtract this 15.
And the rich and old prefer the base address that is you going to get 10,000 hedge.
Now this value is called Delta, so we are going to add this delta value to this address.
So you get 17,000 hits.
So which is 2000 which offset from the base address similar to the previous one?
So this is the process we need to do for all the variables that are hardcoded like this.
So here, if you go to optional header, if you go to this base education table, this address points
to the first
basically regression table.
So if you go to this, this one is the first one.
So this does not have any fixture size, but it has two members.
So here you can see our first eight bytes.
So first four bytes are page are we.
So this page aria is our offset to the page.
So in that page we have some addresses and those need to be fixed.
So the first four pages are page is page three and you can see its 022000.
So here it is, this 22,000 is page are here and the second member is.
And the second number is size.
So the size of the the structure.
He's the second member that is
118018.
So that is the size.
And this first eight eight bites are the two members and the next two members are the addresses, the
offsets, the addresses need to be fixed.
So the first eight bytes are the page area and the size.
So the next two bytes is an offset from this page.
RV So the next two bites are 000.
So if you go ahead and add that, you will get the offset in this page.
And the next two debates and the next two debates and the next two weeks and so on, until you get the
end are the entries.
So we have these entries.
So how we are going to calculate the entries counties.
So we have this the first base relocation size is one eight, right?
So one eight is the total structure size.
So we can say one year, eight minus eight.
So these eight bits are already occupied.
And if I go and delete eight from this, you get the one here zero.
So this.
From here onwards we.
How are the two weight values offsets up to one year zero.
So one year zero or a number of bytes.
But each entry takes two weights of space.
So from this one year zero to get number of entries, you need to divide this value with two.
And here we get the value.
So that is what P does and passes into already passes and calculates.
So we can just see and see that get C and get the value.
So first we are going to do is the calculating the entries count.
So that is very, very important thing.
So let's go and.
So we haven't had a lot of shareholder base relocation to address.
So this when added to the base address gives us the.
Well, our pointer to this one.
So I'm carrying this first base pointer.
And we are going to master this one master pointer.
To structure and first base pointer and Marshall this match base relocation.
So let me call this as first base.
So don't confuse it with the first base point or points to the starting address.
And the first base is the structure.
Now I can go and print this first base dot page or we attached to string.
And here we can see that.
June 20, 2001 eight.
So first we are going to count the entries so we can remove this print.
So first base dot size.
Minus eight.
This gives you the total number of offset size.
So to get the actual number of offsets, we need to divide with two because each offset takes two bytes.
Now we can get the value into entries count.
So we can go and print these entries count.
So if you print this, we get the value, be zero.
So we need to, uh, loop over this.
So how we are gonna report this?
We need to.
And it had the value of this size.
So simply, if you had the size of one eight to this based address based pointer, you get the offset
to the next one.
So it's a very simple one.
So what we're going to do is why first base dot size not is close to zero.
And we are going to add the.
To this point so far.
To this point so far, two basis points, point presses equals two.
We are going to add this one first to base dot size.
So this is the of the structure.
And after that, we need to master this one because after adding the size, it will be pointing to the
next base relocation.
So you can just copy this one.
So now we'll be marshalling as the again first base so you don't have to change these variable names.
Now, we can also put some.
And count.
So if you run this and we get digital e3818, which is exactly what we were showing us.
So we got the entries contract.
So what we're going to do is.
Then.
We are going to print these total offsets.
So let's read this offset.
So how you gonna read this?
How is we going to.
We know the number of entries, right?
So these entries count defines the number of entries.
So what we can do is we can loop over each entries and read these two bytes.
So after reading these two weights, we can add these two weights to this page.
Are we here to get the page offset?
So 22000 +000.
So let's first loop over this for entries close to zero.
It is then.
Entries count, I press.
Press.
So we are looping over all the entries.
And one important thing we need to identify is the year.
So here you can see the first bit.
First to this, four bits are because if you go to P file format in the Microsoft documentation, this
is a based on location types.
So if it is 32 bit, we have the high and low value.
But if it's 64, the first bit is the first four bits are the E.
So ten means in Excel is one year.
So we need to first identify whether it is here or not.
If it's here, then we need to do the difference of 64, 64 bit difference.
Sorry.
64 bit edition.
Additions to that delta.
So how are you going to read this?
So we know that first the West Point Press yet so this gives you the offset to the first entry, right?
So first base point is this one.
There are already eight bytes.
That is page three and the size.
So if you skip these eight bytes, you get the three to the first offset out of here.
So this is like a first one and I need to add a into two because for each time we are we want to skip
two bytes because each offset takes two weights and in the I and this for loop I value is like a iteration.
So we can just simply say I into to for the first iteration, zero and 2 to 0, which gives you only
this value which is of course offset pointer to this one.
And if you use close to one, you'll get the two.
That is, if you had two, you reach here and four, six, eight, ten, etc. So in this way we can
loop over this one.
So I can say in the pointer.
Offset pointer.
So we have this offset pointer and we can use Marshall to read into 64 reading 16 because we are going
to read on it two or two bytes offset, Peter.
So let's call this as offset here.
So let's go and print this.
So here we can see we got the.
iff000.
So we got the exact same values as of this.
So what we're going to do is.
Offset RBA is equal to offset RBA.
I'm going to do the operation with this.
F.
F f.
So now I get only this lawyer.
Two bites.
And here you can see we got the exact offsets.
So zero zero starting and the ending is so there are so many entries, so you can just check we get
the exact values.
So we can call this a string value.
And now what we're going to do is we are going to check if the starting character is here or not, if
of.
Value of zero is equal size equals to year.
Then what we're going to do is we are going to remove the year from this one.
Because we don't need that.
Yeah, we want to add only the remaining value so we can do that using value, not remove.
So we are going to remove the starting index and the length.
So how many number of characters you want to remove from this starting address?
Starting index.
So from zero index that is.
Yeah, I want to remove one character so they will be removed so I can call this string.
Javier.
So I can go and print this page or we're.
So if we get only the.
Exact offsets without.
So let's convert this into the bytes.
So let's call this as bait or veer and we need to convert this into 64 bit integer so we can do that
using convert to in 64.
So we are going to provide the 16 as
it's a trade to treat as a hexadecimal and convert this into integer.
So I think we got the offset.
So now the offset only points to the values without gate.
So all we need to do is we need to add this to the first base page out here.
So first the base dot page, are we a plus offset?
So this gives you the offset from the image based address which contains the value that needs to be
updated.
So to 22,000 plus eight plus to zero, that is this one.
So you need to read the eight bytes and add the data to this in a similar way.
The second.
So the second offset is.
Yeah.
008.
So that means eight bytes from the page are where that is 2 to 0 zero eight.
So if you go to this, these eight bytes needs to be updated to the add it to the Delta.
So we can also add base address.
Boom modify.
PDF.
So we have finally the pointer pointing to the exact address.
So first, it does read martial art read into 64.
So read the eight bytes.
At the address modified pdf.
So at its core, this has previous value.
And this previous value or the data should be added to this previous value.
So let's go and find the data.
So in Peter Delta.
So based address the two in 64 minus.
The preferred way is address that is stored it in the header dot optional header dot image based.
So we got this data value.
So all you need to do is previous value proces equals to da da da two in 16.
Now we are going to write this one.
Right at the two modify pointer, which is pointing at that first address to be relocated and the value
to be written.
So we have successfully written this.
So before any conforming, let's print out all these values and check by putting a breakpoint.
So delta.
So we already print we are already printing the base address in the previous statements.
So we have the data.
Let's also print the.
Preferred.
Bill's address.
Anti header dot option had a dot image based dot to string.
So we are printing the raw database address and preferred way is address and data.
And also we are going to print this to modify pointer so we can directly examine the value at that address.
So let me put a breakpoint here and.
Let's run this.
And we have memory allocated based address.
And the preferred way is address.
And if you go and subtract this period, the delta.
So let's go and see this.
Loaded base Sanders.
Minus preferred base.
Sanders.
So here we can see we got the data value correct.
And the hash to address first value that needs to be relocated is at this address.
So let's go and check at this.
And here we can see 1400 to be one zero.
If you go to this one, you get the exact value.
So after adding that delta.
So this is the delta and this value will be added to this eight bytes.
So 1400 to be one zero.
So this value should be.
We should see here.
So let's go and click on next step into and here we shoot we can see one three of 70, we've v one.
So we have successfully modified all of these values.
So if I go and click on Continue and this next eight bytes will be modified.
So you can see this, all of these.
Values are being updated.
So that's how far this video.
We have successfully updated the base relocations.
Now I think we are good to go to load the executable.
In the previous video, we have already loaded the calculator.
So let's.
Let's roll that.
So if you're going to run this, we should see greater.
Also we can modify the script to load the executable in remote process.
So all you need to do is you need to change these marked copy to read process memory and write process
memory so that we are going to do in the next video.