relocations in coff object files

[sebihepp]

Hello,

I read the documentation of the coff-format from microsoft.
In the relocations you can specify a section, an offset and a symbol.
The offset in the section will be modified by the symbol.
But how is it modified? Is it replaced by the symbol or is the value added?

TIA Sebihepp

[samueldotj]

IIRC, It is based on the FixupType, if it is relative then you have to add the delta otherwise replace it with the symbol value

Sam

[sebihepp]

okay, thanks.
the relocation is declared as IMAGE_REL_I386_DIR32 = 0x0006
Is the relative this? IMAGE_REL_I386_DIR32
Or this? IMAGE_REL_I386_DIR32

[ru2aqare]

okay, thanks.
the relocation is declared as IMAGE_REL_I386_DIR32 = 0x0006
Is the relative this? IMAGE_REL_I386_DIR32
Or this? IMAGE_REL_I386_DIR32

It's the DIR part (DIR = direct, or offset). The REL word after IMAGE indicates RELocation.

[samueldotj]

Code: Select all

#define IMAGE_REL_I386_ABSOLUTE              0           // Reference is absolute, no relocation is necessary
#define IMAGE_REL_I386_DIR16                 01          // Direct 16-bit reference to the symbols virtual address
#define IMAGE_REL_I386_REL16                 02          // PC-relative 16-bit reference to the symbols virtual address
#define IMAGE_REL_I386_DIR32                 06          // Direct 32-bit reference to the symbols virtual address
#define IMAGE_REL_I386_DIR32NB               07          // Direct 32-bit reference to the symbols virtual address, base not included
#define IMAGE_REL_I386_SEG12                 011         // Direct 16-bit reference to the segment-selector bits of a 32-bit virtual address
#define IMAGE_REL_I386_SECTION               012
#define IMAGE_REL_I386_SECREL                013
#define IMAGE_REL_I386_REL32                 024         // PC-relative 32-bit reference to the symbols virtual address

https://svn.symbianos.org/petran/trunk/inc/pe_defs.h

[sebihepp]

hmmm... okay, but then my test object file generated by nasm includes an error.

I defined a dword variable and a function _main in wich the variable is set to 0x0000001
and then a "jmp $". But nasm generates only one section ".text" with the opcodes and
at the end of the opcodes he places the variable. This is correct, but in the "mov [var], 0x01"
opcode he places the offset from the start of the section to the variable and in
the relocation he uses a reference to the ".text" section with IMAGE_REL_I386_DIR32 .
But If I understand you right, then the DIR means the offset is "replaced" by the address
of the section. Then it would change the code and not the variable, right?

My used code is attached to this post.

[ru2aqare]

But If I understand you right, then the DIR means the offset is "replaced" by the address
of the section. Then it would change the code and not the variable, right?

Code: Select all

#define IMAGE_REL_I386_DIR32                 06          // Direct 32-bit reference to the >>>symbols<<< virtual address

This means that whenever the linker encounters a relocation of this type, it inserts the virtual address of the symbol referenced. If by "the code would be overwritten" you mean that the .text section is modified, that is correct. However, only the operand of the mov instruction is modified.

[sebihepp]

Okay, I try it differently:

Code: Select all

Assemblercode:
global _main
_main:
mov dword [var], 0x01
var dd 0x00

Code: Select all

Section .text
  C7 05 //mov dword mem, imm32
  0A 00 00 00 //Offset from the beginning
  01 00 00 00 //Value
  00 00 00 00 //Variable var

And in the Relocations the Offset 03 in the .text Section should be replaced by the
symbol of the .text section. If .text is loaded to linear address 0x00000000, then the
Offset in the mov Operand is changed to 0x00000000, because it will be replaced.
But it should be 0x0A, wich means the start of the .text function plus the value in the
section. Therefore it have to be IMAGE_REL_I386_REL32, haven't it?

[sebihepp]

Or does IMAGE_REL_I386_DIR32 means, the value of the symbol is added?

[ru2aqare]

Or does IMAGE_REL_I386_DIR32 means, the value of the symbol is added?

Yes, the value of the symbol is added to whatever value is found at the relocation. This is done as the compiler may insert an offset measured from the virtual address of the symbol. For example,

Code: Select all

int* a = SomeGlobalIntArray;
int b = a[5];

may generate

Code: Select all

  mov eax, [SomeGlobalIntArray + 5*4]

In this case, the offset is 5*4, and is emitted by the compiler. The address of the array is only known by the linker, so to get the effect intended by the programmer, the virtual address of the symbol is added to whatever value is found at the relocation.

I have previously coded a linker that accepts COFF files as input, and I have found that all _DIRxx type relocations behave this way. _RELxx type relocations, however, ignore the displacement present in the section (well, at least my linker ignores them, and the resulting executables run just fine).

[sebihepp]

okay, thanks.
I had ask, because I want to programm my own Assembler and in future my own
compiler and linker especially for os developing. If everything runs fine, I will post
my programms here.

Greetings Sebihepp

[sebihepp]

Just one simple question again:
It's about the .bf and the .ef in the relocation table. Is it possible to
ignore them? Is it okay if I declare a function just as a symbol?

[ru2aqare]

Just one simple question again:
It's about the .bf and the .ef in the relocation table. Is it possible to
ignore them? Is it okay if I declare a function just as a symbol?

It should be possible, my linker ignores them. I suppose these symbol entries are for debuggers.

[sebihepp]

okay, thanks.

[heyji]

Hello,

I am also trying to understand COFF relocation information and even after reading this thread things are not crystal clear to me. Especially for other relocation types than the one in question in this thread.

The spec says:

VirtualAddress: The address of the item to which relocation is applied. This is the offset from the beginning of the section, plus the value of the section’s RVA/Offset field.
SymbolTableIndex: A zero-based index into the symbol table. This symbol gives the address that is to be used for the relocation.
Type: A value that indicates the kind of relocation that should be performed. Valid relocation types depend on machine type. See section 5.2.1, “Type Indicators.”

And the relocation types I am interested in are:

IMAGE_REL_I386_DIR32 0x0006 The target’s 32-bit VA.
IMAGE_REL_I386_DIR32NB 0x0007 The target’s 32-bit RVA.
IMAGE_REL_I386_SECTION 0x000A The 16-bit section index of the section that contains the target. This is used to support debugging information.
IMAGE_REL_I386_SECREL 0x000B The 32-bit offset of the target from the beginning of its section. This is used to support debugging information and static thread local storage.
IMAGE_REL_I386_TOKEN 0x000C The CLR token.
IMAGE_REL_I386_SECREL7 0x000D A 7-bit offset from the base of the section that contains the target.
IMAGE_REL_I386_REL32 0x0014 The 32-bit relative displacement to the target. This supports the x86 relative branch and call instructions.


Let's say the VirtualAddress field gives a value A1 and that the address of the symbol which index in the symbol Table is SymbolTableIndex is A2. Finally let's say that at the address A1, the value is A3.

If I understand correctly the thread, the relocation 0x0006 is applied in doing :
A3+A2 be stored at A1, instead of A3 ? Is that correct ?

Then for 0x0007 we assume that the symbol at address A2 is in a section which RVA is RVA1. In that case the relocation is applied in doing:
A3+A2-RVA1 be stored at A1, instead of A3 ? Is that correct again (I am not sure at all) ?

And what about the next one ? we assume that the symbol at address A2 is in a section which has a 16-bit index I16. In that case the relocation is applied in doing :
A3+I16 be stored at A1 instead of A3 ? Is that still correct ?

Finally, what is the 32-bit relative displacement of the target mentioned for relocation type 0x0014 ?

Alexandre.