Call instruction changed while running

Question

While debugging and reverse-engineering my exe, I have found a very weird thing.

call ds:GetModuleFileNameA

This call instruction is formed with below hex bytes in IDA.

FF 15 24 C0 41 00

(I think that 0x41C024 means the index of Import Table)

But when I looked this call instruction while debugging it looks as follow.

FF 15 24 C0 1A 00

(Of course, image base is changed 190000 from 400000)

But what I don't understand is how OS (I use win10) automatically changed all offsets in code area.

Can anybody explain?

Answer 1

It is Called Relocation
Every Executable has a section called .reloc

this Section contains details about all addresses that needs to be patched if the imagebase changes

the loader uses this section to change all the modified base address

for example win7 x86 32 bit calc.exe

disassembly from cdb.exe (randomised image base )

002616a3 ff15f4132600    call    dword ptr [calc!_imp__LoadStringW (002613f4)]

disassembly from dumpbin (default imagebase)

C:\>dumpbin  /nologo c:\Windows\System32\calc.exe /disasm /range:0x10016A2,0x10016b1

  010016A2: 50                 push        eax
  010016A3: FF 15 F4 13 00 01  call        dword ptr [__imp__LoadStringW@16]

if you look at the .reloca section you will notice a HIGHLOW entry for address 6A5

Offset(h) 00 01

000B9C00  00 10  ..
000B9C02  00 00  ..
000B9C04  B4 00  ´.
000B9C06  00 00  ..
000B9C08  41 36  A6
000B9C0A  52 36  R6
000B9C0C  A5 36  ¥6 <<<<<
000B9C0E  B3 36  ³6

so the loader can patch the address at RVA ( ImageBase + base of Section + address )

imagebase = 0x1000000 + base of section = 0x1000 + HIGHLOW address = 6a5 
= 0x10016a5

at this address dumpbin has F4 13 00 01 whereas cdb has f4 13 26 00

the loader has patched it according to the image base

this post of mine has more details about what is patched

update wrt comment some exes dont have .reloc

yes it is entirely possible to have exes without reloc
infact there is a msvc linker switch /FIXED if passed produces exes without relocations

in most of the cases exes can survive without relocations because they are the first to be loaded in Process Address Space
so they tend to get their Preferred ImageBase always

Relocations matter most with Dlls especially those dlls that woud be Dynamically Loaded or loaded as a dependency to another dll

in this case clashes can happen and os needs a mechanism to relocate the binary in question

if windows cant relocate the dll it crashes the application with

C:\>cdb -c "!error c0000018;q" cdb | tail -n 3
0:000> cdb: Reading initial command '!error c0000018;q'
Error code: (NTSTATUS) 0xc0000018 (3221225496) - {Conflicting Address Range}  The specified address range conflicts with
 the address space.
quit: