Page 1 of 1

I want to keep the relocation table

Posted: Tue May 04, 2021 10:23 am
by jessielesbian
I saw that EVB removes the relocation table from the executable. I want to keep the relocation table since I want to combine EVB with another packer.

Re: I want to keep the relocation table

Posted: Wed May 05, 2021 11:07 am
by Enigma
EVB does not remove the relocation table, it merges relocation table of main application with relocation table of loader, and it also being moved to EVB section of PE file.

Using another packer with EVB may not be possible. EVB uses PE section offset for initialization. EVB adds two sections to the file and uses their offsets from the PE header (from memory, not from file).
After packing these offsets are being corrupted, together with sections number, so packed file does not work.

Best recommendation is to use Enigma Protector instead of EVB, as for packing and protection.
Or use packer first then EVB, but this scheme could also not work.