2

I'm analyzing entries in the relocation section of a binary. In particular, I want to know if all the targets of jumps have a corresponding entry in the relocation section. The screenshot shows the relocation section entries of the binary I'm analyzing, to the left, as well as the assembly code of the binary showing only the jump instructions, to the right.

Relocation section and disassembly of binary

From what I understand, the first instruction in the assembly code at address 0x40be04 (jmp *0x4f422c) should have an entry in the relocation section. However, the last entry in the relocation section is for address 0x401fee.

Why don't some addresses have an entry in the relocation section? Am I misunderstanding something in my analysis?

P.S: The screenshot shows the binary disassembled using objdump on cygwin. The relocation section entries were generated using PE-Parser (https://github.com/trailofbits/pe-parse)

2

There are a couple of possiblities here.

One possibility is that the relocation table has been truncated, so you see only the first page of relocation items (the table is an array of items on a per-page basis).

Another possiblity is that the file doesn't support ASLR (perhaps intentionally, or perhaps it is assumed to not exist) so the relocation table isn't parsed. This would allow the address at 0x40be04 to execute even in the absence of a relocation item, because the image will never be loaded to another address.

Further, the disassembly itself looks strange, as though the file is obfuscated. If so, then it is quite possible that the author of the obfuscator does not take ASLR into account, and so did not bother to add relocation items for the relevant jump.

3
  • Thanks for your reply. The disassembly shows only the jump instructions in the binary. I have edited the post to say this. – redraga Jul 29 '14 at 18:38
  • The issue was with the tool not showing all the pages of the relocation table. I was able to see all the entries using the pefile module for python. – redraga Aug 1 '14 at 22:06
  • @redraga: since it seems peter's answer was helpful, you should probably accept it (click the check mark next to it) – Igor Skochinsky Aug 3 '14 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.