Reputation: 5241
From the above we can see count of relocation table entries is 0
(there is no reloc item), but offset of first reloc item shows that the reloc item actually exists.
The definition of DOS EXE Header is here.
How to understand it?
Upvotes: 0
Views: 2501
Reputation: 27300
You have to look at the EXE header size (shown as DOS_HdrSize
in your screenshot). This is the number of paragraphs (16-byte blocks) that the whole header uses.
In your example it is 0x0004
so multiply it by 16 and you get the header length as 0x40
bytes. The relocation table starts at the relocation table offset and continues for DOS_ReloCnt
entries until the end of the header.
In your case the relocation table offset is 0x40
and the end of the header is also 0x40
thus there is no room for the relocation table, which is just as well since DOS_ReloCnt
says there are zero entries in it.
In this case it probably does not matter what value the relocation table offset is set to.
Upvotes: 1
Reputation: 25809
This is normal. For modern formats like PE, the offset to the relocation table is always 0040H, even if there are zero relocation items.
Upvotes: 1