Reverse Engineering Asked on December 28, 2021
I understand that the relocation table exists for when an image isn’t loaded at its preferred address, but if an image isn’t loaded at its preferred address, doesn’t everything need to be relocated relative to the actual load address? Isn’t that the whole point of an RVA? What makes addresses that have entries in the relocation table different?
(My first question, please point out mistakes if I made them. Thanks.)
Relative Virtual Address = RVA it is relative within the address space
jmp here+78 will always jump +78 from wherever here is
now jump 402078 will always try to jump to 402078
this will only succeed if 402078's preferred loading address was 400000 and the binary
loaded at 400000
if it loaded at 600000 then 402078 does not exist in that address space and will result in access vioaltion
here relocation table is required
Loader when loading the binary will check preferred address and patch the 402078 to 602078 when loading
Answered by blabb on December 28, 2021
Get help from others!
Recent Answers
Recent Questions
© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP