added a PE_find_static_relative_reference function (not used yet)

Function that can be used to find cross-references of a global variable
or a function

EDRSandblast/Includes/PEParser.h

@@ -58,5 +58,5 @@ PVOID PE_functionAddr(PE* pe, LPCSTR functionName);
 VOID PE_parseRelocations(PE* pe);
 VOID PE_rebasePE(PE* pe, LPVOID newBaseAddress);
 PVOID PE_search_pattern(PE* pe, PBYTE pattern, size_t patternSize);
-PVOID PE_search_relative_reference(PE* pe, PVOID target, DWORD relativeReferenceSize);
+DWORD PE_find_static_relative_reference(PE* pe, DWORD targetRVA, DWORD relativeReferenceSize, DWORD fromRVA);
 VOID PE_destroy(PE* pe);

EDRSandblast/Utils/PEParser.c

@@ -356,60 +356,78 @@ PVOID PE_search_pattern(PE* pe, PBYTE pattern, size_t patternSize) {
     return NULL;
 }
 
-PVOID PE_search_relative_reference(PE* pe, PVOID target, DWORD relativeReferenceSize) {
+/*
-	signed long long int maximum;
+* Look for an instruction that references address targetRVA relatively from its own address, starting the search at fromRVA.
-	signed long long int minimum;
+* Searches a 8, 16 or 32 bits relative displacement that points to targetRVA (on x86_84, 64-bits relative displacements do not exist)
+* Returns the RVA of the reference (in the middle of the instruction)
+* 
+* Example:
+*
+* PAGE:14084EA2B 45 33 FF                             xor     r15d, r15d
+* PAGE:14084EA2E 4C 8D 2D [6B DA 49 00]               lea     r13, PspCreateProcessNotifyRoutine ; array at address 140CEC4A0
+* PAGE:14084EA35 4E 8D 24 FD 00 00 00 00              lea     r12, ds:0[r15*8]
+*
+* At address 14084EA31 (14084EA2E+3), we find the DWORD 0x0049DA6B (see brackets), which is a displacement relative to the
+* address of the next instruction (14084EA35). 0x0049DA6B + 0x14084EA35 being equal to 0x140CEC4A0, this is how the array
+* PspCreateProcessNotifyRoutine is referenced by the lea instruction.
+*/
+DWORD PE_find_static_relative_reference(PE* pe, DWORD targetRVA, DWORD relativeReferenceSize, DWORD fromRVA) {
+    QWORD startRVA;
+    QWORD endRVA;
 
     switch (relativeReferenceSize)
     {
     case 1:
-		minimum = MININT8;
+        startRVA = (QWORD)targetRVA - MAXINT8 - relativeReferenceSize;
-		maximum = MAXINT8;
+        endRVA = (QWORD)targetRVA - MININT8 - relativeReferenceSize;
         break;
     case 2:
-		minimum = MININT16;
+        startRVA = (QWORD)targetRVA - MAXINT16 - relativeReferenceSize;
-		maximum = MAXINT16;
+        endRVA = (QWORD)targetRVA - MININT16 - relativeReferenceSize;
         break;
     case 4:
-		minimum = MININT32;
+        startRVA = (QWORD)targetRVA - MAXINT32 - relativeReferenceSize;
-		maximum = MAXINT32;
+        endRVA = (QWORD)targetRVA - MININT32 - relativeReferenceSize;
         break;
     default:
-		minimum = 0;
+        return 0;
-		maximum = 0;
+    }
-		break;
+    if (startRVA > targetRVA) {
+        startRVA = 0;
+    }
+    if (startRVA < fromRVA) {
+        startRVA = fromRVA;
+    }
+    if (endRVA > MAXDWORD) {
+        endRVA = MAXDWORD;
     }
     for (int i = 0; i < pe->ntHeader->FileHeader.NumberOfSections; i++) {
-		DWORD sectionVA = pe->sectionHeaders[i].VirtualAddress;
+        DWORD startRVA_inSection = pe->sectionHeaders[i].VirtualAddress;
-		DWORD sectionSize = pe->sectionHeaders[i].Misc.VirtualSize;
+        startRVA_inSection = max(startRVA_inSection, (DWORD)startRVA);
-		DWORD targetRVA = PE_Addr_to_RVA(pe, target);
+        DWORD endRVA_inSection = startRVA_inSection + pe->sectionHeaders[i].Misc.VirtualSize - relativeReferenceSize;
-		//TODO : implement optimization rva in range(targetRVA - maximum - relativeReferenceSize,targetRVA + minimum - relativeReferenceSize) inter range(sectionVA, sectionVA+sectionSize)
+        endRVA_inSection = min(endRVA_inSection, (DWORD)endRVA);
-		for (DWORD rva = sectionVA; rva <= sectionVA + sectionSize - relativeReferenceSize; rva++) {
+        for (DWORD rva = startRVA_inSection; rva <= endRVA_inSection; rva++) {
             switch (relativeReferenceSize) {
             case 1:
                 if (rva + relativeReferenceSize + *(INT8*)PE_RVA_to_Addr(pe, rva) == targetRVA) {
-					return PE_RVA_to_Addr(pe, rva);
+                    return rva;
                 }
                 break;
             case 2:
                 if (rva + relativeReferenceSize + *(INT16*)PE_RVA_to_Addr(pe, rva) == targetRVA) {
-					return PE_RVA_to_Addr(pe, rva);
+                    return rva;
                 }
                 break;
             case 4:
                 if (rva + relativeReferenceSize + *(INT32*)PE_RVA_to_Addr(pe, rva) == targetRVA) {
-					return PE_RVA_to_Addr(pe, rva);
+                    return rva;
                 }
                 break;
-			default:
-				minimum = 0;
-				maximum = 0;
-				break;
             }
         }
 
     }
-	return NULL;
+    return 0;
 }
 
 VOID PE_destroy(PE* pe)