def parse_relocations(image, module_base_address, pe, data_rva, rva, size):
data = image[data_rva:data_rva + size]
file_offset = pe.get_offset_from_rva(data_rva)
entries = []
for idx in range(len(data) / 2):
entry = pe.__unpack_data__(pe.__IMAGE_BASE_RELOCATION_ENTRY_format__,
data[idx * 2:(idx + 1) * 2],
file_offset=file_offset)
if not entry:
break
word = entry.Data
relocation_type = (word >> 12)
relocation_offset = (word & 0x0fff)
relocation_data = pefile.RelocationData(struct=entry,
type=relocation_type,
base_rva=rva,
rva=relocation_offset + rva)
if relocation_data.struct.Data > 0 and \
(relocation_data.type == pefile.RELOCATION_TYPE['IMAGE_REL_BASED_HIGHLOW'] or
relocation_data.type == pefile.RELOCATION_TYPE['IMAGE_REL_BASED_DIR64']):
entries.append(relocation_data)
file_offset += entry.sizeof()
return entries
def new_reloc_entry(addr, type):
entry = pefile.Structure(pe.__IMAGE_BASE_RELOCATION_ENTRY_format__)
assert (0 <= type <= 11), 'invalid type'
setattr(entry, 'Data', (addr & 0xFFF) + (type << 12))
entry.set_file_offset(0)
return pefile.RelocationData(struct=entry,
type=type,
base_rva=addr & ~0xFFF,
rva=addr)