Base Relocation Directory¶

What relocations are¶

Code and data in a PE file contain absolute addresses (pointers, vtables, jump tables) computed for the preferred OptionalHeader.ImageBase. When the loader maps the image somewhere else, which ASLR does on almost every run, each of those addresses must be adjusted by the difference between the actual and the preferred base:

delta         = actual ImageBase − preferred ImageBase
patched value = stored value + delta

The base relocation directory is the list of places that need this fix-up. It is stored as blocks, one per 4 KB page, and each block holds 2-byte entries: a 4-bit type (how wide the patch is) and a 12-bit offset inside the page.

Blocks (upper list)¶

Entries (lower list)¶

Select a block to list its entries:

Rebase preview¶

Above the entries sits Rebase to ImageBase, a read-only "what if" calculator. It never modifies the file.

1. Select a block in the upper list.
2. Double-click the Rebase to ImageBase box and type the base address you're interested in (hex, no 0x), for example the base a debugger or crash dump reports for the module.
3. PPEE shows the delta next to the box (delta +7FF4D2340000) and fills the Rebased column with each fixed-up value, using the same arithmetic as the Windows loader for each type.
4. Step through other blocks: the typed base is kept, so you can scan the whole table at one base.
5. Reset returns to the file's own ImageBase (delta +0, so Rebased equals Value).

In the screenshot, the module was loaded at 7FF612340000 instead of its preferred 140000000, so the stored pointer 00000001401D6890 becomes 00007FF612516890, the address you would see in memory.

Typical uses:

• Match a memory dump or debugger to the file. Enter the runtime base your debugger reports for the module and read off the runtime value of any pointer slot, then use Target to see which function or data it refers to.
• Check a manual unpack or rebuilt image. After dumping a module from memory, the stored values are already rebased. Enter the dump's base to confirm the relocations line up, or compare Rebased at the original base with Value.
• Understand ASLR behavior by comparing Value (preferred base) with Rebased (actual base).

Relocations in malware analysis¶

Working with memory dumps¶

A module dumped from memory contains pointers that were already relocated to the base it was loaded at, while its header usually still says the preferred ImageBase:

1. Find the base the module was loaded at, for example 7FF612340000.
2. Open the original file, select a relocation block, and type that base into Rebase to ImageBase. The Rebased column now shows exactly the values you should find in the dump.
3. Compare them with the dump's Value column. Matching values confirm the dump is consistent; mismatches point at data the malware changed at run time (decrypted strings, patched pointers, hooks).
4. To make a dump's pointers resolve in static tools, set the dump's header to the runtime base (--set OptionalHeader.ImageBase=…): the Target column then resolves instead of showing <outside image>.

# Point a dump's header at the base it was taken from
ppee-cli --set OptionalHeader.ImageBase=00007FF612340000 --save -o dump.fixed.exe dump.exe > /dev/null

Editing relocations¶

• In the upper list, block RVA and BlockSize are editable.
• In the lower list, Offset is editable and Type has a picker. The change is written into the entry's 2-byte word in the file, and the RVA, Value, Target and Rebased columns update from the patched data.
• Save with Ctrl+S. Changing relocations changes how the loader patches the image, so test the result.

From the CLI:

ppee-cli --basereloc f.exe | head -3
# Does the EXE support relocation at all?
ppee-cli --json --basereloc f.exe | jq '.baseRelocations | length > 0'
# Entries per type across the whole directory
ppee-cli --json --basereloc f.exe | jq '[.baseRelocations[].entries[].type] | group_by(.) | map({type: .[0], count: length})'

The rebase preview is a GUI feature. In JSON, each entry has offset and type, and the RVA is pageRVA + offset.

# RELOCS_STRIPPED / ASLR check for a folder
for f in samples/*; do ppee-cli --no-similarity --json --headers --basereloc "$f" 2>/dev/null | jq -r --arg f "$f" '
  def h: ascii_downcase | explode | reduce .[] as $c (0; . * 16 + (if $c >= 97 then $c - 87 else $c - 48 end));
  def bit($n): (. / $n | floor) % 2 == 1;
  "\($f)\tblocks=\(.baseRelocations | length)\tstripped=\(.headers["FileHeader.Characteristics"] | h | bit(1))\taslr=\(.headers["OptionalHeader.DllCharacteristics"] | h | bit(64))"'
done

Related: --basereloc · Hardening flags · Hex View

References¶

• Microsoft PE format specification, base relocations: relocation blocks and types.
• /DYNAMICBASE, address space layout randomization (Microsoft): the linker option behind the DYNAMIC_BASE flag.