Relocation table of PE

In the previous chapters, we assumed that executable files must be mounted on the image base expected by the compiler. However, in the following cases, we may need to mount the PE module on an image base that is not expected at the time of compilation:

• There must be multiple mounted PE modules in a single process (regardless of EXE or DLL) and it is obvious that the common 0x400000 image address cannot be chosen for each DLL module during compilation.

Therefore, Microsoft designed relocation for PE, which is used to solve the challenge of mapping a PE module to an unexpected image base.

• In the Calling programs directly in memory section of Chapter 5, we encountered a similar problem with the application loader that we tried to replicate. Since the application loader is already mapped to 0x400000, it is no longer possible to mount the EXE file on the occupied 0x400000 memory.
• With the Service Pack 2 (SP2) patch, Windows XP provides Address...