Missing addresses from relocation section of ASLR enabled PE binary

Question

I'm analyzing entries in the relocation section of a binary. In particular, I want to know if all the targets of jumps have a corresponding entry in the relocation section. The screenshot shows the relocation section entries of the binary I'm analyzing, to the left, as well as the assembly code of the binary showing only the jump instructions, to the right.

From what I understand, the first instruction in the assembly code at address 0x40be04 (jmp *0x4f422c) should have an entry in the relocation section. However, the last entry in the relocation section is for address 0x401fee.

Why don't some addresses have an entry in the relocation section? Am I misunderstanding something in my analysis?

P.S: The screenshot shows the binary disassembled using objdump on cygwin. The relocation section entries were generated using PE-Parser (https://github.com/trailofbits/pe-parse)

Answer 1

There are a couple of possiblities here.

One possibility is that the relocation table has been truncated, so you see only the first page of relocation items (the table is an array of items on a per-page basis).

Another possiblity is that the file doesn't support ASLR (perhaps intentionally, or perhaps it is assumed to not exist) so the relocation table isn't parsed. This would allow the address at 0x40be04 to execute even in the absence of a relocation item, because the image will never be loaded to another address.

Further, the disassembly itself looks strange, as though the file is obfuscated. If so, then it is quite possible that the author of the obfuscator does not take ASLR into account, and so did not bother to add relocation items for the relevant jump.