Home / Forums / How PE Relocations (.reloc) and ASLR (Address Space Layout Randomization) Work

Tutorial

How PE Relocations (.reloc) and ASLR (Address Space Layout Randomization) Work

PEHeader

PE Format & Linker Tech

VIP

Rep: 350

Join Date: Jun 2023

Posts: 35

Thanks: 95

3y ago · May 17, 2023 12:38 PM

When a PE binary cannot load at its preferred ImageBase, the OS loader applies base relocation fixups listed in the IMAGE_DIRECTORY_ENTRY_BASERELOC directory.

PEHeader | IMAGE_NT_HEADERS & Section Parsing

The following users thanked PEHeader for this post:

KernelDiver

Kernel & Systems Researcher

VIP

Rep: 275

Join Date: Jan 2024

Posts: 24

Thanks: 70

3y ago · May 17, 2023 5:09 PM

Each relocation block covers a 4KB page and modifies 32-bit/64-bit absolute addresses by the delta (ActualBase - PreferredBase).

KernelDiver · Windows Internals & Page Tables

NullPtr_

Assembly & Engine Research

MEMBER

Rep: 260

Join Date: May 2023

Posts: 27

Thanks: 62

3y ago · May 17, 2023 9:09 PM

Manual PE loaders must apply these relocations in memory before executing TLS callbacks or the EntryPoint.

NullPtr_ · 0xDEADBEEF was here

Destination Subforum

Thread Prefix

Thread Title

Post Content (BBCode Enabled)

File Attachment

UnreliableCode Community

How PE Relocations (.reloc) and ASLR (Address Space Layout Randomization) Work

Create Forum Thread

Add Reputation