Custon PE Loader - Not working for every binary
by red_dot - Monday January 22, 2024 at 05:40 PM
#1
Hello,
I have a problem with my custom PE Loader it's like a fucking lottery some binaries are working and others not. By working i mean they are successfully executed in memory and do its job. 

So in short my loader performs these actions:
  1. Parse PE file
  2. Allocate RW with aligned size of image
  3. Temporary copy headers to allocated memory
  4. Copy sections to allocated memory
  5. Calculate delta and perform relocations 
  6. Resolve Import Address Table (IAT)
  7. Set appropriate protection flags for each section by their Characteristics
  8. Execute TLS callbacks
  9. Clear headers
  10. If DLL build exports and call DllMain
  11. If EXE just call entry point

Is there anything i forgot to cover in my loader? I was wondering if i need to allocate TLS Slots or sth.
Generally loader works but for some binaries like Xmrig.exe it doesnt (ACCESS VIOLATION) i will try to debug more in the future but maybe someone experienced can see my mistakes from high level overview.

Thanks Big Grin
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  Pure Go In Memory COFFLoader (also PE loader) Unethical 14 1,405 03-19-2025, 07:45 AM
Last Post: Punj4b1
  Bypass Cookies Encryption | Working FrancisMDouble 5 890 02-15-2025, 01:49 AM
Last Post: d4rkd4rkl1ght
  FAKE UNITY GAME | LOADER | DELETE WIN DEF jazet 6 804 11-15-2024, 04:41 PM
Last Post: Brownsugar281

Forum Jump:


 Users browsing this thread: 1 Guest(s)