| Previous | Next |
| STATUS_EVALUATION_EXPIRATION | STATUS_LICENSE_VIOLATION |
STATUS_ILLEGAL_DLL_RELOCATION
The image cannot be safely rebased around the system DLL layout
When a DLL cannot use its preferred image base, the loader can apply base relocations if valid relocation data exists. This status is more specific: the relocation arrangement conflicts with an address region reserved for system DLLs, producing a layout that Windows will not accept for normal execution.
The durable correction is a properly linked and serviced binary. Editing preferred bases or disabling address randomization can create new collisions and security regressions, especially when the image has assumptions about fixed addresses or missing relocation records.
What to inspect
- Record preferred and actual image bases, relocation-table presence, and every module occupying the conflicting range.
- Check whether the DLL was linked with a fixed base, stripped relocations, or modified after linking.
- Verify that system DLLs come from the current Windows servicing level and have not been replaced manually.
- Rebuild or obtain an updated vendor binary instead of applying header-only base-address patches.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: PE and COFF format
- Microsoft: Exploit protection reference
- Wine source: PE mapping and relocation
Looking for a different code? Search another status or error code.