3

A friend and I are poking around with some 32-bit Windows binaries and wanted to get some info about relocation tables.

  1. What is the difference between an exe that does not contain a relocation table (its base memory always starts at a specific address e.g. 0x0040000), and an exe that does contain a relocation table with a base memory that starts at different addresses?

  2. What are the benefits or detriments to having a relocation table and not having one in an exe?

  3. If an exe has a relocation table already inside of it, what will happen if it is removed? What are the consequences of doing so?

1 Answer 1

1

Relocation tables exist to load a binary To a different Imagebase instead of the preferred Imagebase embedded in pe header

Imagebase relocation is mostly applicable to dlls as image base conflicts have more chances to happen in dlls

Exe is normally the first image to be loaded so it normally tends to get its preferred imagebase 0x400000 in x86

You can compile an exe without relocation table using /Fixed /DynamicBase:no linker options

You can rip out a relocation table and theoretically the binary should work alright at its preferred imagebase

2
  • subject to ASLR restrictions, depending on the size of the stack and heap, which might end up occupying the place where the image wants to go. Mar 20 at 3:18
  • @peterferrie 😀 yes theoratically i meant
    – blabb
    Mar 20 at 3:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.