0

I am looking at the dll loader in carberp and there is this line i dont understand.

for (DWORD i = 0; i < ((Relocation->SizeOfBlock - IMAGE_SIZEOF_BASE_RELOCATION) / 2 ); i++, RelInfo++ )

You can have a look at the source code on the link below.

https://github.com/hzeroo/Carberp/blob/master/source%20-%20absource/pro/all%20source/BlackJoeWhiteJoe/Source/DllLoader.cpp

I mean i understand the for loop, but what is "sizeofblock- image_sizeof_base_relocation / 2" .

Please help.

Improve this question

1 Answer 1

Reset to default
1

According to MSDN : (go down to PE File Base Relocations part)

The relocation section is array of blocks, each one contains:

(IMAGE_BASE_RELOCATION, relocations binary chunck)

In order to calculate how many relocations in specific block you need to take SizeOfBlock out of IMAGE_BASE_RELOCATION subtract the size of an IMAGE_BASE_RELOCATION and split by each relocation size (which is sizeof(WORD)=2 bytes):

(Relocation->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD)

hope this help you

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .