PE loader needs to process relocations

[Masrepus]

Consider the
reloaderd sample (from this year's FlareOn): This crashes the loader, as it tries to directly map the PE at a location that is intentionally defined to mess with loaders. The PE loading mechanism should consider using relocations if the image base is just too high to work.

[Masrepus]

Ah I just looked at the loader code in more detail, and it looks like you are actually already doing relocations. But unfortunately the loader does not consider that the base address might be too high, and just allocates memory from image base onwards. Thus the crash happens already before any actual image loading happens.

[aquynh]

As usual, please send pull req to fix the issue, if you can :-)

[Masrepus]

Will take a look at it

[Dliv3]

I added some code to limit the PE base address and relocate the PE, but the pefile's relocate_image api will have an error when relocating the reloaderd.exe. I need to look at the pefile code because I think this might be a pefile bug.