WIN7_LDR_DATA_TABLE_ENTRY结构(x86 x64)

本文详细解析了 LDR_DATA_TABLE_ENTRY 结构,在 x86 和 x64 架构下的定义及其组成元素,包括 DLL 基地址、入口点等关键信息。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

typedef struct _LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID      DllBase;
PVOID      EntryPoint;
ULONG32    SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
UINT32   Unknow[17];

}LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

//x86





typedef struct _LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID      DllBase;
PVOID      EntryPoint;
ULONG32    SizeOfImage;
UINT8      Unknow0[0x4];
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
}LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

//x64



解析代码 .global reset_got .type reset_got, %function ; .type fixup_gdt_reloc, %function ; reset_got: pie_fixup: ldr r0, =pie_fixup ldr r1, =PAGE_START_MASK and r0, r0, r1 #mov_imm r1, \_pie_fixup_size add r1, r1, r0 bl fixup_gdt_reloc /* Relocation codes */ #define R_ARM_RELATIVE 23 fixup_gdt_reloc: mov r6, r0 mov r7, r1 #if ENABLE_ASSERTIONS /* Test if the limits are 4K aligned */ orr r0, r0, r1 mov r1, #(PAGE_SIZE_MASK) tst r0, r1 ASM_ASSERT(eq) #endif /* * Calculate the offset based on return address in lr. * Assume that this function is called within a page at the start of * fixup region. */ ldr r1, =PAGE_START_MASK and r2, lr, r1 subs r0, r2, r6 /* Diff(S) = Current Address - Compiled Address */ beq 3f /* Diff(S) = 0. No relocation needed */ ldr r1, =__GOT_START__ add r1, r1, r0 ldr r2, =__GOT_END__ add r2, r2, r0 /* * GOT is an array of 32_bit addresses which must be fixed up as * new_addr = old_addr + Diff(S). * The new_addr is the address currently the binary is executing from * and old_addr is the address at compile time. */ 1: ldr r3, [r1] /* Skip adding offset if address is < lower limit */ cmp r3, r6 blo 2f /* Skip adding offset if address is > upper limit */ cmp r3, r7 bhi 2f add r3, r3, r0 str r3, [r1] 2: add r1, r1, #4 cmp r1, r2 blo 1b /* Starting dynamic relocations. Use ldr to get RELA_START and END */ 3: ldr r1, =__RELA_START__ add r1, r1, r0 ldr r2, =__RELA_END__ add r2, r2, r0 /* * According to ELF-32 specification, the RELA data structure is as * follows: * typedef struct { * Elf32_Addr r_offset; * Elf32_Xword r_info; * } Elf32_Rela; * * r_offset is address of reference * r_info is symbol index and type of relocation (in this case * code 23 which corresponds to R_ARM_RELATIVE). * * Size of Elf32_Rela structure is 8 bytes. */ /* Skip R_ARM_NONE entry with code 0 */ 1: ldr r3, [r1, #4] ands r3, r3, #0xff beq 2f #if ENABLE_ASSERTIONS /* Assert that the relocation type is R_ARM_RELATIVE */ cmp r3, #R_ARM_RELATIVE ASM_ASSERT(eq) #endif ldr r3, [r1] /* r_offset */ add r3, r0, r3 /* Diff(S) + r_offset */ ldr r4, [r3] /* Skip adding offset if address is < lower limit */ cmp r4, r6 blo 2f /* Skip adding offset if address is >= upper limit */ cmp r4, r7 bhs 2f add r4, r0, r4 str r4, [r3] 2: add r1, r1, #8 cmp r1, r2 blo 1b bx lr
最新发布
07-26
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值