Robert Baruch autophile@starband.net writes:
My current idea is to go into PE_fixup_imports, unprotect the .idata section, do the fixups, and reprotect the section.
Imports are not necessarily contained in the .idata section. Also base relocations can touch just about every code page, so you'd need to unprotect everything. Probably easier to only set up the right permissions after all imports and relocations have been done.
Also note that it is allowed for an app to write to the resource section, even though it is marked read-only. NT sets up an exception handler to unprotect it when necessary; this is supposed to help in finding bugs. So you probably have to do the same thing.