Skip to content

Full DLL Unhooking with C++ - Relocations not needed #37

Open
@GuyPerson7018

Description

@GuyPerson7018

In this page, it is stated that relocations may need to be fixed, and ntdll does not have any relocations to fix. However, ntdll does indeed have relocations (in fact, my version holds 7577 relocations), as can be seen if you open it in CFF Explorer. Indeed, this is because CreateFileMapping and MapViewOfFile already does the relocations for you. As such, no matter what DLL you use, this method should work to map it into memory without needing to solve for relocations (even the more complex ones such as kernel32.dll). In fact, if you implement your own mapping function (using things such as fopen), you will see that the ImageBase observed is completely different from the ImageBase you get after using CreateFileMapping and MapViewOfFile

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions