Unmanaged Relocations

[QERT2002]

AsmResolver Version

6.0.0 beta5

.NET Version

.NET Framework 4.8

Operating System

Windows

Describe the Bug

Dude, I don't know shit about DLLs and headers, but I had a task to change the exports (increasing the length of the original strings and rebuilding the export table in lexicographic order for GetProcAddress to work)

Even without making any changes, the library increases in size when rebuilt and the tls sections are broken (that's what my friend said) in relocations at the address of the tls directory members are duplicated

tls directory relocations duplicated

address of callbacks invalid

How To Reproduce

string inputPath = "GameAssembly.dll";
string outputPath = "GameAssembly_Patched.dll";

var peImage = PEImage.FromFile(inputPath);
UnmanagedPEFileBuilder builder = new UnmanagedPEFileBuilder();
var file = builder.CreateFile(peImage);
file.Write(outputPath);

Expected Behavior

Normal operation of the DLL

Actual Behavior

The DLL will not load via LoadLibraryA or W
with a read error at the address in ntdll.dll
LdrpAllocateTlsEntry

Additional Context

Dlls.zip

[Washi1337]

Thanks for the report, #708 should address this problem. Let me know if it indeed fixes your issue (artifacts can be downloaded once the pipeline completes).

As for size increase, this is expected with UnmanagedPEFileBuilder as it may have to add additional sections if things do not fit in their original place anymore (e.g., when adding items to an export directory). See also the docs.

[QERT2002]

I test artifact on my own dll's and all works good, thank you <3
The dll size also decreased, although this was not critical.

[Washi1337]

Thanks! The new version will be available on nightly shortly, and will be included in the next release on nuget.