CODEWITHSUNDEEP
coff
udpsunil
udpsunil

Reputation: 1375

In the COFF file format, what is the significance of the relocation information section?

I am reading about COFF file formats, which is commonly used to create an executable file format (it has some variants also).

While reading, I came across the relocation section of the format. How is this relocation section used to create an executable file.

It would be very useful if you point me to some links which will help me.

Upvotes: 5

Views: 2044

Answers (3)

Scott Wisniewski
Scott Wisniewski

Reputation: 25031

Actually, with COFF there are 2 types of relocation information:

  1. COFF Relocation records
  2. The relocation section in an executable image.

They have similar, but different purposes. The relocation information in an executable identifies things that need to be fixed up, at load time, should the executable image be loaded at a different addresses from its preferred address.

COFF Relocation records identify things that need to be fixed up, at link time, when a section in an object file is assigned to an offset in an executable image.

Upvotes: 8

Cthulhon
Cthulhon

Reputation: 637

An unintended addition use of relocation is (de-)obfuscating binaries at run time with no additional unpacking code. See this paper.

Upvotes: 2

Oliver Mellet
Oliver Mellet

Reputation: 2387

Relocation is used to place executable code in its own memory space in a process. For example, if you try to load two dlls that both request the same base address (ie, the same place in memory), then one of the dlls will have to be relocated to another address. NTCore is a useful site for exploring Portable Executable (PE) files, which is what COFF is now called. Here is another site that explains relocation pretty well.

Upvotes: 4

Related Questions