relocs

Tool tools/pe/relocs.py (program, Windows PE). List the pointers in a PE file's data, found from its base relocations.

Run it with ./gameframe run relocs ARGS or python3 tools/pe/relocs.py. Source on GitHub.

Its own help

This is the help text in the tool itself, as ./gameframe tool relocs prints it.

List the pointers in a PE file's data, found from its base relocations.

Usage: relocs.py BINARY [--min N] [--all]

The loader must change every absolute address in the image when it loads the image at another
base. The base relocation table (.reloc) lists each of those places. In code, they are
instructions that use an absolute address. In data, each one is a pointer. Runs of pointers
next to each other are tables: vtables, tables of functions, tables of strings, tables of
records. A recursive disassembler misses functions that are reached only through such tables.

The tool prints each run of at least N pointers (default 2) outside the code sections, with
the kind of each target: code, a string, or other data. --all also prints single pointers.
DLLs keep their relocations. Many 32-bit EXEs were linked without them (/FIXED); the tool says
so. 64-bit code uses relative addresses, so its code has few relocations, while its data
pointers are still listed.

Named by

Skills: re-ghidra.