为啥呢?是修改的时候手抖了吗?眼花?神经衰弱?非也,是这些文章错了!我们先来看看微软官方权威的《Microsoft PE and COFF Specification》
以下文字来自Microsoft PE and COFF Specification(Updated: September 21, 2010 File name: pecoff_v8.docx)
5.6 The .reloc Section (Image Only)
The base relocation table contains entries for all base relocations in the image. The Base Relocation Table field in the
optional header data directories gives the number of bytes in the base relocation table. For more information,
see section 3.4.3, “Optional Header Data Directories (Image Only).” The base relocation table is divided into blocks.
Each block represents the base relocations for a 4K page. Each block must start on a 32-bit boundary.
可以看到,微软的文档中并没有说重定位表需要padding zero来作为end标志。
下面我们看看到底windows中是怎么处理这个重定位表的,下面是反汇编windows xp sp2的 ntdll.dll,实际的LoadLibraryA/W最后会调用到 LdrLoadDll(x, x, x, x)