lief-project
simple parse and rebuild of calc.exe
Following the tutorial directions, I cannot do a simple parse and rebuild of calc.exe and other binaries.
self.fileParsed = lief.parse(theFile) builder = lief.PE.Builder(self.fileParsed) # Configure it to rebuild and patch the imports builder.build_imports(True).patch_imports(True) # Build ! builder.build() # Save the result builder.write(outputname)
the rebuilt exe generates a windows error message: Windows Calculator has stopped working.
Hello @joemikhailgwu
Does it still fail if you set builder.build_imports(False).patch_imports(False) ?
Yes it does fail.
Joe
Sent from my iPhone
On Nov 16, 2019, at 7:59 AM, Romain [email protected] wrote:
Hello @joemikhailgwu Does it still fail if you set builder.build_imports(False).patch_imports(False) ?
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.
@joemikhailgwu which Calculator? The Windows 10 modern application usually found here: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1910.0.0_x64__8wekyb3d8bbwe\Calculator.exe?
Calc.exe in system32
Sent from my iPhone
On Jan 23, 2020, at 2:46 PM, Elias Bachaalany [email protected] wrote:
@joemikhailgwu which Calculator? The Windows 10 modern application usually found here: C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1910.0.0_x64__8wekyb3d8bbwe\Calculator.exe?
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.
I have not tried your case exactly but I suspect the problem is that when patch_imports is used, then LIEF hardcodes the addresses to the import stubs w/o adding proper relocation information.
Try deleting the relocations or disabling ASLR and see if that works:
# Disable ASLR
binary.optional_header.dll_characteristics &= ~lief.PE.DLL_CHARACTERISTICS.DYNAMIC_BASE
I have checked the source code of the imports patcher and I see no sign for relocation adding for the import trampoline pointers. If I have time, I might fix the code but maybe @romainthomas has it already.
@joemikhailgwu @0xeb I didn't look at this issue yet but if you have a fix I can do a review.
