Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What happens if I delete the Relocation table address from PE Header?

I'm analyzing some cracks, and one of them changed the Relocation Table address and size to 0. What the cracker was trying to achieve with this?

To provide more information, the objective of the crack is load another DLL, changing the name of a previous windows DLL name in load table for a custom one.

like image 498
Filipe Carvalho Avatar asked Oct 29 '25 09:10

Filipe Carvalho


1 Answers

Deleting relocating table guarantees that DLL can't be relocated.
So new code (code of crack) don't need to calculate any address in DLL and can use constant address values.

Also often relocation table is not actually necessary, so it can be removed to reduce size of module, or to replace it with some data.

like image 169
Abyx Avatar answered Oct 31 '25 17:10

Abyx