[madaboo]

Hi,

Assuming that one function can be viewed in windbg like this:
804e3c06 ff2508355580 jmp dword ptr [nt!blahblahblah (80553508)]
804e3c0c 90 nop
804e3c0d 90 nop

now going to address 80553508
I can see it's code.

Now I'm calculating RVA of this address: 80553508 - KernelBase. Now I'm converting this Rva2Offset in ntoskrnl.exe (however it seems that this particular file is properly aligned, so I can skip this step). Then I'm opening ntoskrl.exe in hex editor , going to address that is equal to RVA and I can see ff2508c54700 which seems to be correct since, ff35 is opcode, and 0047c508 - 0x400000(image base) +kernel base = 80553508.
Now my problem is that I need to look under this address (in file: va:0047c508, rva:0007c508) in file, but when I'm going to this address in hex editor I'm seeing '0'... what I'm missing here? I assume that something with relocations, Can you give me a way how can I read proper values under this address?

Thanks.

[holly]

The image layout is different between file and memory,you need to translate va:0047c508, rva:0007c508 to file offset.
offset = RVA2Offset(0007c508)

[madaboo]

Holly,

Thanks for joining.
Well as I've written before this particular file is properly aligned, so I'm afraid it won't help - since offset and rva are same.
Any other ideas?
Why there are 0s?

[madaboo]

Ok the thing I was able to check was
804e3c06 ff2508355580 jmp dword ptr [nt!blahblahblah (80553508)]

that 80553508 - KernelBAse gives ue RVA(and in this particular case raw offset) to DATA segment.
It seems that this segment is filled later, but I thought that if I map image (create section, mapview of section etc) then the PE file should be loaded, with all relocation (I mean windows loader should work here) isn't it? If so then I still don't understand why I see zeros there.

Any suggestions?

[holly]

804e3c06 ff2508355580 jmp dword ptr [nt!blahblahblah (80553508)]
This line seems like IAT stuff or something other stub.
You can post your .sys,or we guess all the time.
And mapping image (create section, mapview of section etc) just load the PE file into memory as image without relocation and IAT building.

[madaboo]

Holly again thank you for joinging.
Well finally I found the way how to ommit my problem different way, but now I would like to know how can I rebuild relocation table and IAT by myselft after performing zwcreatesection and mapviewofsection. Can you please show me the way how to achieve this?

Maybe there exist open source code that does this?

Thanks

[holly]

wrk source is there for you.
MmLoadSystemImage