third_party/pefile_py3/pefile.py
def relocate_image(self, new_ImageBase):
        """Apply the relocation information to the image using the provided new image base.

        This method will apply the relocation information to the image. Given the new base,
        all the relocations will be processed and both the raw data and the section's data
        will be fixed accordingly.
        The resulting image can be retrieved as well through the method:

            get_memory_mapped_image()

        In order to get something that would more closely match what could be found in memory
        once the Windows loader finished its work.
        """

        relocation_difference = new_ImageBase - self.OPTIONAL_HEADER.ImageBase

        if (len(self.OPTIONAL_HEADER.DATA_DIRECTORY)>=6 and
            self.OPTIONAL_HEADER.DATA_DIRECTORY[5].Size):
            if not hasattr(self, 'DIRECTORY_ENTRY_BASERELOC'):
                self.parse_data_directories(
                    directories=[DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_BASERELOC']])
            for reloc in self.DIRECTORY_ENTRY_BASERELOC:

                virtual_address = reloc.struct.VirtualAddress
                size_of_block = reloc.struct.SizeOfBlock

                # We iterate with an index because if the relocation is of type
                # IMAGE_REL_BASED_HIGHADJ we need to also process the next entry
                # at once and skip it for the next iteration
                #
                entry_idx = 0
                while entry_idx<len(reloc.entries):

                    entry = reloc.entries[entry_idx]
                    entry_idx += 1

                    if entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_ABSOLUTE']:
                        # Nothing to do for this type of relocation
                        pass

                    elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_HIGH']:
                        # Fix the high 16-bits of a relocation
                        #
                        # Add high 16-bits of relocation_difference to the
                        # 16-bit value at RVA=entry.rva

                        self.set_word_at_rva(
                            entry.rva,
                            ( self.get_word_at_rva(entry.rva) + relocation_difference>>16)&0xffff )

                    elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_LOW']:
                        # Fix the low 16-bits of a relocation
                        #
                        # Add low 16 bits of relocation_difference to the 16-bit value
                        # at RVA=entry.rva

                        self.set_word_at_rva(
                            entry.rva,
                            ( self.get_word_at_rva(entry.rva) + relocation_difference)&0xffff)

                    elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_HIGHLOW']:
                        # Handle all high and low parts of a 32-bit relocation
                        #
                        # Add relocation_difference to the value at RVA=entry.rva

                        self.set_dword_at_rva(
                            entry.rva,
                            self.get_dword_at_rva(entry.rva)+relocation_difference)

                    elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_HIGHADJ']:
                        # Fix the high 16-bits of a relocation and adjust
                        #
                        # Add high 16-bits of relocation_difference to the 32-bit value
                        # composed from the (16-bit value at RVA=entry.rva)<<16 plus
                        # the 16-bit value at the next relocation entry.
                        #

                        # If the next entry is beyond the array's limits,
                        # abort... the table is corrupt
                        #
                        if entry_idx == len(reloc.entries):
                            break

                        next_entry = reloc.entries[entry_idx]
                        entry_idx += 1
                        self.set_word_at_rva( entry.rva,
                            ((self.get_word_at_rva(entry.rva)<<16) + next_entry.rva +
                            relocation_difference & 0xffff0000) >> 16 )

                    elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_DIR64']:
                        # Apply the difference to the 64-bit value at the offset
                        # RVA=entry.rva

                        self.set_qword_at_rva(
                            entry.rva,
                            self.get_qword_at_rva(entry.rva) + relocation_difference)

            self.OPTIONAL_HEADER.ImageBase = new_ImageBase

            #correct VAs(virtual addresses) occurrences in directory information
            if hasattr(self, 'DIRECTORY_ENTRY_IMPORT'):
                for dll in self.DIRECTORY_ENTRY_IMPORT:
                    for func in dll.imports:
                        func.address += relocation_difference
            if hasattr(self, 'DIRECTORY_ENTRY_TLS'):
                self.DIRECTORY_ENTRY_TLS.struct.StartAddressOfRawData += relocation_difference
                self.DIRECTORY_ENTRY_TLS.struct.EndAddressOfRawData   += relocation_difference
                self.DIRECTORY_ENTRY_TLS.struct.AddressOfIndex        += relocation_difference
                self.DIRECTORY_ENTRY_TLS.struct.AddressOfCallBacks    += relocation_difference
            if hasattr(self, 'DIRECTORY_ENTRY_LOAD_CONFIG'):
                if self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.LockPrefixTable:
                    self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.LockPrefixTable += relocation_difference
                if self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.EditList:
                    self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.EditList += relocation_difference
                if self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.SecurityCookie:
                    self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.SecurityCookie += relocation_difference
                if self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.SEHandlerTable:
                    self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.SEHandlerTable += relocation_difference
                if self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.GuardCFCheckFunctionPointer:
                    self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.GuardCFCheckFunctionPointer += relocation_difference
                if self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.GuardCFFunctionTable:
                    self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.GuardCFFunctionTable += relocation_difference
Apply the relocation information to the image using the provided new image base.

        This method will apply the relocation information to the image. Given the new base,
        all the relocations will be processed and both the raw data and the section's data
        will be fixed accordingly.
        The resulting image can be retrieved as well through the method:

            get_memory_mapped_image()

        In order to get something that would more closely match what could be found in memory
        once the Windows loader finished its work.
        
Apply the relocation information to the image using the provided new image base.
This method will apply the relocation information to the image. Given the new base,
all the relocations will be processed and both the raw data and the section's data
will be fixed accordingly.
The resulting image can be retrieved as well through the method.



In order to get something that would more closely match what could be found in memory
once the Windows loader finished its work.
Apply the relocation information to the image using the provided new image base . This method will apply the relocation information to the image . Given the new base all the relocations will be processed and both the raw data and the section ' s data will be fixed accordingly . The resulting image can be retrieved as well through the method . In order to get something that would more closely match what could be found in memory once the Windows loader finished its work .
def relocate_image(self, new_ImageBase):
        relocation_difference = new_ImageBase - self.OPTIONAL_HEADER.ImageBase
        if (len(self.OPTIONAL_HEADER.DATA_DIRECTORY)>=6 and
            self.OPTIONAL_HEADER.DATA_DIRECTORY[5].Size):
            if not hasattr(self, 'DIRECTORY_ENTRY_BASERELOC'):
                self.parse_data_directories(
                    directories=[DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_BASERELOC']])
            for reloc in self.DIRECTORY_ENTRY_BASERELOC:
                virtual_address = reloc.struct.VirtualAddress
                size_of_block = reloc.struct.SizeOfBlock
                entry_idx = 0
                while entry_idx<len(reloc.entries):
                    entry = reloc.entries[entry_idx]
                    entry_idx += 1
                    if entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_ABSOLUTE']:
                         Nothing to do for this type of relocation
                        pass
                    elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_HIGH']:
                         Fix the high 16-bits of a relocation
                         Add high 16-bits of relocation_difference to the
                         16-bit value at RVA=entry.rva
                        self.set_word_at_rva(
                            entry.rva,
                            ( self.get_word_at_rva(entry.rva) + relocation_difference>>16)&0xffff )
                    elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_LOW']:
                         Fix the low 16-bits of a relocation
                         Add low 16 bits of relocation_difference to the 16-bit value
                         at RVA=entry.rva
                        self.set_word_at_rva(
                            entry.rva,
                            ( self.get_word_at_rva(entry.rva) + relocation_difference)&0xffff)
                    elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_HIGHLOW']:
                         Handle all high and low parts of a 32-bit relocation
                         Add relocation_difference to the value at RVA=entry.rva
                        self.set_dword_at_rva(
                            entry.rva,
                            self.get_dword_at_rva(entry.rva)+relocation_difference)
                    elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_HIGHADJ']:
                         Fix the high 16-bits of a relocation and adjust
                         Add high 16-bits of relocation_difference to the 32-bit value
                         composed from the (16-bit value at RVA=entry.rva)<<16 plus
                         the 16-bit value at the next relocation entry.
                         If the next entry is beyond the array's limits,
                         abort... the table is corrupt
                        if entry_idx == len(reloc.entries):
                            break
                        next_entry = reloc.entries[entry_idx]
                        entry_idx += 1
                        self.set_word_at_rva( entry.rva,
                            ((self.get_word_at_rva(entry.rva)<<16) + next_entry.rva +
                            relocation_difference & 0xffff0000) >> 16 )
                    elif entry.type == RELOCATION_TYPE['IMAGE_REL_BASED_DIR64']:
                         Apply the difference to the 64-bit value at the offset
                         RVA=entry.rva
                        self.set_qword_at_rva(
                            entry.rva,
                            self.get_qword_at_rva(entry.rva) + relocation_difference)
            self.OPTIONAL_HEADER.ImageBase = new_ImageBase
            correct VAs(virtual addresses) occurrences in directory information
            if hasattr(self, 'DIRECTORY_ENTRY_IMPORT'):
                for dll in self.DIRECTORY_ENTRY_IMPORT:
                    for func in dll.imports:
                        func.address += relocation_difference
            if hasattr(self, 'DIRECTORY_ENTRY_TLS'):
                self.DIRECTORY_ENTRY_TLS.struct.StartAddressOfRawData += relocation_difference
                self.DIRECTORY_ENTRY_TLS.struct.EndAddressOfRawData   += relocation_difference
                self.DIRECTORY_ENTRY_TLS.struct.AddressOfIndex        += relocation_difference
                self.DIRECTORY_ENTRY_TLS.struct.AddressOfCallBacks    += relocation_difference
            if hasattr(self, 'DIRECTORY_ENTRY_LOAD_CONFIG'):
                if self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.LockPrefixTable:
                    self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.LockPrefixTable += relocation_difference
                if self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.EditList:
                    self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.EditList += relocation_difference
                if self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.SecurityCookie:
                    self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.SecurityCookie += relocation_difference
                if self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.SEHandlerTable:
                    self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.SEHandlerTable += relocation_difference
                if self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.GuardCFCheckFunctionPointer:
                    self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.GuardCFCheckFunctionPointer += relocation_difference
                if self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.GuardCFFunctionTable:
                    self.DIRECTORY_ENTRY_LOAD_CONFIG.struct.GuardCFFunctionTable += relocation_difference
def relocate_image ( self , new_ImageBase ) : relocation_difference = new_ImageBase - self . OPTIONAL_HEADER . ImageBase if ( len ( self . OPTIONAL_HEADER . DATA_DIRECTORY ) >= 6 and self . OPTIONAL_HEADER . DATA_DIRECTORY [ 5 ] . Size ) : if not hasattr ( self , 'DIRECTORY_ENTRY_BASERELOC' ) : self . parse_data_directories ( directories = [ DIRECTORY_ENTRY [ 'IMAGE_DIRECTORY_ENTRY_BASERELOC' ] ] ) for reloc in self . DIRECTORY_ENTRY_BASERELOC : virtual_address = reloc . struct . VirtualAddress size_of_block = reloc . struct . SizeOfBlock entry_idx = 0 while entry_idx < len ( reloc . entries ) : entry = reloc . entries [ entry_idx ] entry_idx += 1 if entry . type == RELOCATION_TYPE [ 'IMAGE_REL_BASED_ABSOLUTE' ] : pass elif entry . type == RELOCATION_TYPE [ 'IMAGE_REL_BASED_HIGH' ] : self . set_word_at_rva ( entry . rva , ( self . get_word_at_rva ( entry . rva ) + relocation_difference >> 16 ) & 0xffff ) elif entry . type == RELOCATION_TYPE [ 'IMAGE_REL_BASED_LOW' ] : self . set_word_at_rva ( entry . rva , ( self . get_word_at_rva ( entry . rva ) + relocation_difference ) & 0xffff ) elif entry . type == RELOCATION_TYPE [ 'IMAGE_REL_BASED_HIGHLOW' ] : self . set_dword_at_rva ( entry . rva , self . get_dword_at_rva ( entry . rva ) + relocation_difference ) elif entry . type == RELOCATION_TYPE [ 'IMAGE_REL_BASED_HIGHADJ' ] : if entry_idx == len ( reloc . entries ) : break next_entry = reloc . entries [ entry_idx ] entry_idx += 1 self . set_word_at_rva ( entry . rva , ( ( self . get_word_at_rva ( entry . rva ) << 16 ) + next_entry . rva + relocation_difference & 0xffff0000 ) >> 16 ) elif entry . type == RELOCATION_TYPE [ 'IMAGE_REL_BASED_DIR64' ] : self . set_qword_at_rva ( entry . rva , self . get_qword_at_rva ( entry . rva ) + relocation_difference ) self . OPTIONAL_HEADER . ImageBase = new_ImageBase if hasattr ( self , 'DIRECTORY_ENTRY_IMPORT' ) : for dll in self . DIRECTORY_ENTRY_IMPORT : for func in dll . imports : func . address += relocation_difference if hasattr ( self , 'DIRECTORY_ENTRY_TLS' ) : self . DIRECTORY_ENTRY_TLS . struct . StartAddressOfRawData += relocation_difference self . DIRECTORY_ENTRY_TLS . struct . EndAddressOfRawData += relocation_difference self . DIRECTORY_ENTRY_TLS . struct . AddressOfIndex += relocation_difference self . DIRECTORY_ENTRY_TLS . struct . AddressOfCallBacks += relocation_difference if hasattr ( self , 'DIRECTORY_ENTRY_LOAD_CONFIG' ) : if self . DIRECTORY_ENTRY_LOAD_CONFIG . struct . LockPrefixTable : self . DIRECTORY_ENTRY_LOAD_CONFIG . struct . LockPrefixTable += relocation_difference if self . DIRECTORY_ENTRY_LOAD_CONFIG . struct . EditList : self . DIRECTORY_ENTRY_LOAD_CONFIG . struct . EditList += relocation_difference if self . DIRECTORY_ENTRY_LOAD_CONFIG . struct . SecurityCookie : self . DIRECTORY_ENTRY_LOAD_CONFIG . struct . SecurityCookie += relocation_difference if self . DIRECTORY_ENTRY_LOAD_CONFIG . struct . SEHandlerTable : self . DIRECTORY_ENTRY_LOAD_CONFIG . struct . SEHandlerTable += relocation_difference if self . DIRECTORY_ENTRY_LOAD_CONFIG . struct . GuardCFCheckFunctionPointer : self . DIRECTORY_ENTRY_LOAD_CONFIG . struct . GuardCFCheckFunctionPointer += relocation_difference if self . DIRECTORY_ENTRY_LOAD_CONFIG . struct . GuardCFFunctionTable : self . DIRECTORY_ENTRY_LOAD_CONFIG . struct . GuardCFFunctionTable += relocation_difference
Apply the relocation information to the image using the provided new image base.
Apply the relocation information to the image using the provided new image base .
"""Apply the relocation information to the image using the provided new image base.

        This method will apply the relocation information to the image. Given the new base,
        all the relocations will be processed and both the raw data and the section's data
        will be fixed accordingly.
        The resulting image can be retrieved as well through the method:

            get_memory_mapped_image()

        In order to get something that would more closely match what could be found in memory
        once the Windows loader finished its work.
        """ # We iterate with an index because if the relocation is of type # IMAGE_REL_BASED_HIGHADJ we need to also process the next entry # at once and skip it for the next iteration # # Nothing to do for this type of relocation # Fix the high 16-bits of a relocation # # Add high 16-bits of relocation_difference to the # 16-bit value at RVA=entry.rva # Fix the low 16-bits of a relocation # # Add low 16 bits of relocation_difference to the 16-bit value # at RVA=entry.rva # Handle all high and low parts of a 32-bit relocation # # Add relocation_difference to the value at RVA=entry.rva # Fix the high 16-bits of a relocation and adjust # # Add high 16-bits of relocation_difference to the 32-bit value # composed from the (16-bit value at RVA=entry.rva)<<16 plus # the 16-bit value at the next relocation entry. # # If the next entry is beyond the array's limits, # abort... the table is corrupt # # Apply the difference to the 64-bit value at the offset # RVA=entry.rva #correct VAs(virtual addresses) occurrences in directory information
self
new_ImageBase