tags:

views:

47

answers:

2

alt text

From the above we can see count of relocation table entries is 0(there is no reloc item), but offset of first reloc item shows that the reloc item actually exists.

The definition of DOS EXE Header is here.

How to understand it?

A: 

This article might help.

KMan
I've read that article before,but it seem didn't answer my question.
COMer
A: 

This is normal. For modern formats like PE, the offset to the relocation table is always 0040H, even if there are zero relocation items.

I. J. Kennedy
Does the relocation table take up any space if there's no items?
COMer
No, the relocation table doesn't take up any space if there are zero items. Take a look at the bytes at offset 0040H. You'll see the first machine instructions of the program.
I. J. Kennedy