I did just a little bit of additional research and got it to not relocate it! The PE file has a section called ".reloc" and a data directory IMAGE_DIRECTORY_ENTRY_BASERELOC (both should point to the same place in the file). It lists all the places where relocations need to occur. Very near the beginning was the one we were looking for. Changing it to 0s made it ignored (whenever the first 4 bits are 0, the entire relocation entry is ignored).
You can read more about them at Peering Inside the PE: A Tour of the Win32 Portable Executable File Format
in the section "PE File Base Relocations" and Inside Windows: An In-Depth Look into the Win32 Portable Executable File Format, Part 2
in the section "Base Relocations". I used PE View (WJR's PEview(PE/COFF File Viewer), xlatHinc, M(Mandelbrot Set), Awpm
) to look at the file and find it.
I zeroed it out, retested, and voilą it works! I will have to add a little something to my program to automatically search for and zero out overwritten relocations.
I will send you an updated document soon with how this all finally worked. As a note there will likely be some changes to get it to work in 64-bit.
Quote: Originally Posted by joakim
Thanks for giving such an utterly excellent example of a trial & error method. I never thought of this.
Thanks! I thought it was pretty clever too, and actually went pretty quickly. Some changes I could do right in IDA without re-disassembling (as long as they were the same length assembly instructions).
Each one is its own thing. I may have fixed the 32-bit winresume issue just I haven't tested. I have no idea about the 64-bit winresume issue at the moment. The long copyright testing I am quite certain works, I just haven't tested it since I changed my patching system and got SP1 working. The last one I have one idea left to test, and hopefully that will be it! Otherwise I will release it with that issue still there. All in all, this isn't too big of problems to work out, and hopefully this weekend, time permitting, I will release it.