| Previous | Next |
| STATUS_FT_READ_FROM_COPY | STATUS_WAKE_SYSTEM |
STATUS_IMAGE_AT_DIFFERENT_BASE
Relocation is required because the preferred image base is unavailable
A PE optional header records a preferred ImageBase. If that address range is already occupied or address-space randomization selects another location, the loader maps the image elsewhere and applies entries from the base-relocation table. This informational status indicates relocation, not corruption, when the required fixups are present and valid.
Problems arise when an image was linked with relocation data stripped, contains malformed relocation blocks, or embeds absolute pointers that are not represented in the relocation table. Modern ASLR intentionally makes successful rebasing routine, so code should not depend on a fixed module address.
What to inspect
- Compare the preferred ImageBase with the actual mapped base and calculate the relocation delta.
- Inspect the PE base-relocation directory and confirm that the image was not linked with relocations stripped.
- Look for crashes in custom loaders, packers, or hand-written assembly that retain unrelocated absolute addresses.
- Use module-relative offsets rather than persisting process-specific virtual addresses.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: PE and COFF format
- Microsoft: Exploit protection reference
- Wine source: PE mapping and relocation
Looking for a different code? Search another status or error code.