Search code examples
windowsportable-executable

How to get relocated base address in PE Files?

I'm trying to make Simple PE Packer. My PE Viewer show me base address 0x40000000, but OllyDbg show me 0x01900400 or other address.

I guess that it is address relocation.

  1. how to get relocated address ?
  2. what do make packer simple sequence ?
Solution

  • A PE file has a preferred base address. If you're writing a PE Viewer, then it sounds like it will analyze the PE file only. This is a static analysis, so you'll only get the preferred base address, which is 0x40000000.

    OllyDbg is a debugger, which is a totally different thing than a PE Viewer. A debugger performs a dynamic analysis at runtime. At runtime, the PE file might have been loaded to a different address, since the preferred address was already used.

    So, in my opinion, your PE Viewer program does what it should do - except if you wanted to write a debugger.