@ britedream:
You turned my attention to another aspect of ASPR, thanks for that! Later I will have a look at the thread mentioned by SatyricOn.
@ SatyricOn:
Quote:
|
Remember, all sections after .rsrc (including .adata and .data) should be deleted entirely
|
Yes, I know. I'm afraid this will be another long, long evening... *sigh*
Quote:
|
after you have relocated any useful data out of them.. hint, hint
|
Hmmm... so the first thing I should do is figuring out what data is needed and what data is trash.
So far I know that the data in .mackt is needed since it contains the IAT. That mean I need to find a way to store the IAT entries somewhere else.
Quote:
|
This would not be good.. The BSS section is used at runtime by Delphi (remember that data morphing again?), so your import table would be overwritten at runtime. Which wouldn't be a good thing....
|
Perhaps my explanation of what to do with .mackt was kind of rubbish (sorry for that, English is not my native language
)
I thought of using only the _disk_ space at offset 226000 to store the .mackt part, but without changing the virtual offset of the .mackt section. While loading the app, the loader would see that the section located at file-offset 22600 should go to VA 313000 in memory, so the section at VA 22600 isn't occupied and Delphi can use it for whatever it wants.
Quote:
|
FYI, the DATA section is for initialized data, the BSS section is for uninitialized data (namely, the data is initialized at runtime).
|
Ahh... good thing to know
Thanks!
Regards
Wurstgote