ida plugin for RFG fixups processing

I commited today code for Ida Pro plugin for RFG fixups processing - for both version 1 & 2

It seems that by default during automatic loading of pe files Ida don`t load .reloc section (where usually located RFG fixups). In such case I ask if you want to add new segment:

Sure it works only if original input file (you can extract it with get_input_file_path function) is still available. Also I used dirty hack - I am too lazy to parse PE file by hand, and it seems that node "$ PE header" keeps all sections (even not loaded in base !) in supvals

enjoy

Update: it seems that buggy ida sdk don`t contains doCode function and auto_mark_range actually does not take into account end argument, so body of prologs looks ugly

IMAGE_DYNAMIC_RELOCATION_TABLE.Version 2

it seems that around since w10 build 15007 format of rfg relocs was changed and field IMAGE_DYNAMIC_RELOCATION_TABLE.Version now has value 2. So lets install platform SDK for 15003 and see what was changed

First remarkable thing is that IMAGE_LOAD_CONFIG_DIRECTORY now has two additional fields:
    WORD       DynamicValueRelocTableSection;
    WORD       Reserved2;
    // since w10 build 15003 ?
    ULONGLONG  GuardRFVerifyStackPointerFunctionPointer; // VA
    DWORD      HotPatchTableOffset;
} IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64;

so sizeof(IMAGE_LOAD_CONFIG_DIRECTORY64) is now 0xf4

apisetschema.dll from windows 10 build 15025

lots of new modules was added:

• win-core-registry-fromapp
• win-gaming-expandedresources
• win-gaming-gamemonitor
• win-ngc-serialization
• win-security-isolatedcontainer
• win-shcore-path
• onecore-appmodel-tdlmigration 
• onecore-hcap-svf
• onecore-hnetcfg
• onecore-mpc-input
• onecore-shlwapi
• onecore-spectrumsyncclient
• win-adsi-activeds
• win-appcompat-aepic
• win-appmodel-restrictedappcontainer-internal
• win-audiocore-spatial
• win-base-rstrtmgr
• win-core-iuri
• win-core-winsrv
• win-deployment-productenumerator
• win-dx-dinput8
• win-eventing-pdh
• win-fs-cscapi
• win-gaming-gamechatoverlay
• win-gdi-gdiplus
• win-hyperv-compute
• win-kernel32-process
• win-kioskmode-config
• win-mapi-mapi32
• win-mininput-inputhost
• win-mm-wmvcore
• win-net-netbios
• win-net-netshell
• win-net-nfdapi
• win-nfc-semgr
• win-ntuser-rawinput
• win-odbc-odbc32
• win-parentalcontrols-setup
• win-resources-deployment
• win-rtcore-ntuser-winevent
• win-security-appinfoext
• win-security-certpoleng
• win-security-slc
• win-shell-aclui
• win-shell-comctl32
• win-shell-efsadu
• win-shell-ntshrui
• win-shell-shdocvw
• win-wnv

KiServiceTable from windows 10 build 15007 x64

KiServiceLimit .eq. 0x1c8

KiServiceTable from windows 10 build 15007

KiServiceLimit .eq. 0x1c8

KiServiceTable from windows 10 build 14986

KiServiceLimit .eq. 0x1c5

W32pServiceTableFilter from windows 10 build 14951 x64

kd> ? nt!KeServiceDescriptorTableFilter
Evaluate expression: -8795428636992 = fffff800`2799b6c0

kd> dps fffff800`2799b6c0
fffff800`2799b6c0  fffff800`278f4450 nt!KiServiceTable
fffff800`2799b6c8  00000000`00000000
fffff800`2799b6d0  00000000`000001c4
fffff800`2799b6d8  fffff800`278f4b64 nt!KiArgumentTable
fffff800`2799b6e0  ffffa344`ba544bc0 win32k!W32pServiceTableFilter
fffff800`2799b6e8  00000000`00000000
fffff800`2799b6f0  00000000`0000049c
fffff800`2799b6f8  ffffa344`ba5462d4 win32k!W32pArgumentTableFilter