如果我从 PE 标头中删除重定位表地址会发生什么？
我正在分析一些破解，其中一个将重定位表地址和大小更改为 0。破解者试图通过此实现什么目的？
为了提供更多信息，破解的目的是加载另一个 DLL，将加载表中以前的 Windows DLL 名称更改为自定义的 DLL。
I'm analyzing some cracks, and one of them changed the Relocation Table address and size to 0. What the cracker was trying to achieve with this?
To provide more information, the objective of the crack is load another DLL, changing the name of a previous windows DLL name in load table for a custom one.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
删除重定位表可以保证DLL不能被重定位。
因此新代码（破解代码）不需要计算DLL中的任何地址，并且可以使用常量地址值。
通常重定位表实际上并不是必需的，因此可以将其删除以减小模块的大小，或者用一些数据替换它。
Deleting relocating table guarantees that DLL can't be relocated.
So new code (code of crack) don't need to calculate any address in DLL and can use constant address values.
Also often relocation table is not actually necessary, so it can be removed to reduce size of module, or to replace it with some data.
根据可移植可执行文件规范，仅当库必须加载到其首选加载地址之外的另一个地址。因此，只要库加载到其首选地址（事实上，当映像不支持 ASLR 时就会发生这种情况），从目录中删除重定位表就不会产生任何影响。
According to the Portable Executable Specification, a relocation table is only needed when a library must be loaded at another address than its preferred load address. So, deleting the relocation table from the directory does not have any impact as long as the library is loaded at its preferred address (which is as matter of fact taking place when the image does NOT support ASLR).
要更改要加载的 DLL 的名称，通常只需更改导入表即可。剩下的只是猜测工作，不知道相关二进制文件的具体情况。
我认为重要的是要认识到并非所有“黑客”都知道他们到底在做什么，也许您正在分析一些根本不应该分析的东西。
也就是说，您可能出于以下几个原因想要删除重定位：
To change the name of a DLL to load, you would normally just change the import table. The rest is just guess work, without knowing the specifics of the binaries in question.
I believe it's important to realize that not all 'crackers' know what exactly they're doing, maybe you're analyzing into something that shouldn't be analyzed at all.
That said, you might want to remove relocation for a few reasons: