title: PE injection image relocation
body: <p>All,</p>
  
  <p>I have been trying to figure this out for a couple of days now and I need some help.</p>
  
  <p>For a research project for work I have written some custom malware, the malware itself is not the issue here and I won't share any code, but I do need some help on the actual injector.</p>
  
  <p>I have some problems trying to fully understand how and when I need to perform manual relocations. I am not relocating at the moment and using a random address from virtualallocex, and everything just works. My malware exe runs and I have no issues UNLESS the memory location where the remote process PE is loaded at overlaps with my malware PE preferred base address.</p>
  
  <p>I am not using NtUnmapViewOfSection as it gets detected by AntiVirus and basically is just a crap function that randomly doesn't work, so my plan is to just use a random address provided by VirtualAllocEx and relocate if need be (which I don't understand, see questions hereunder).</p>
  
  <p>This is my current working method (unless target process overlaps with preferredbase):</p>
  
  <ol>
  <li>Download malware exe and place in buffer</li>
  <li>CreateProcess to start victim process</li>
  <li>Suspend the thread right after (I'm not using CREATE_SUSPENDED flag as this does not work in win10)</li>
  <li>Get necessary header info from the buffer (PIMAGE_DOS_HEADER, PIMAGE_NT_HEADERS), also get the ImageBase address from remote process PEB</li>
  <li>Allocate memory in target process (VirtualAllocEx), using NULL for lpAddress so virtualAllocEx can choose the location</li>
  <li>Write PE headers and sections to the memory location</li>
  <li>Protect Memory</li>
  <li>Change EAX to new entrypoint</li>
  <li>Change PEB to new baseAddress</li>
  <li>ResumeThread</li>
  <li>Profit</li>
  </ol>
  
  <p>So please help me understand the following:</p>
  
  <ol>
  <li><p>Why does this work without doing any manual relocations, is there some magic PE loader in the background that does this even though I'm injecting?</p></li>
  <li><p>Why doesn't it work when the target process overlaps with the preferred base address. The PE image itself is copied in a non-overlapping memory location, so how in the hell is that any different from my working solution when the target process doesn't overlap. It should just do the magic relocation thing from my first question.</p></li>
  <li><p>Why do I see so many people change the preferredBaseAddress in the image before writing it to memory? To my knowledge this field is only used to map PE to their preferredbaseaddress, if they can't do that the PE loader performs the relocations. Seeing as injection code usually performs its own manual relocations I have no idea why they would change this.</p></li>
  </ol>
  
  <p>Hopefully somebody can help me understand, because this is driving me nuts :).</p>
  
  <p>Best regards! </p>