.OBJ File Format – Relocations

COFF object file

The compiler doesn’t know where a function or variable will end up, so it leaves a placeholder and writes a relocation: a note telling the linker what to patch. Each section has its own list, found through the section header.

The relocation record

IMAGE_RELOCATION, 10 bytes:

OffsetSizeFieldMeaning
04VirtualAddressThe offset in the section of the field to patch. In the first record of a section with LNK_NRELOC_OVFL, this is the real number of relocations.
44SymbolTableIndexThe symbol whose address goes in the field, as a record index in the symbol table, counting auxiliary records.
82TypeHow to patch the field, which depends on the machine; see Types.

The field’s own bytes hold an addend: the compiler puts 4 into a displacement for example, and the linker adds it to the symbol’s address.

Types

The table lists the types for the four common machines. The prefix of the constant is IMAGE_REL_AMD64_, IMAGE_REL_I386_, IMAGE_REL_ARM_ or IMAGE_REL_ARM64_.

Valuex64x86ARMARM64
0x0ABSOLUTEABSOLUTEABSOLUTEABSOLUTE
0x1ADDR64DIR16ADDR32ADDR32
0x2ADDR32REL16ADDR32NBADDR32NB
0x3ADDR32NBBRANCH24BRANCH26
0x4REL32BRANCH11PAGEBASE_REL21
0x5REL32_1REL21
0x6REL32_2DIR32PAGEOFFSET_12A
0x7REL32_3DIR32NBPAGEOFFSET_12L
0x8REL32_4SECREL
0x9REL32_5SEG12SECREL_LOW12A
0xASECTIONSECTIONREL32SECREL_HIGH12A
0xBSECRELSECRELSECREL_LOW12L
0xCSECREL7TOKENTOKEN
0xDTOKENSECREL7SECTION
0xESREL32SECTIONADDR64
0xFPAIRSECRELBRANCH19
0x10SSPAN32MOV32BRANCH14
0x11THUMB_MOV32REL32
0x12THUMB_BRANCH20
0x14REL32THUMB_BRANCH24
0x15THUMB_BLX23
0x16PAIR

The most common are REL32, a 32-bit distance from the end of the field to the symbol (with REL32_1 to REL32_5 when that many more bytes of the instruction follow the field), the 32-bit and 64-bit absolute addresses, ADDR32NB, a 32-bit address relative to the image base, and SECREL, the symbol’s offset in its section, used by debug information. The specification also defines the types of older machines such as MIPS.