[Stylo]

Hi,
Just wondered about something . .
how does windbg can tell when a modules has been relocated using the command !imgreloc ?
is it depends of the preferred address that is inside the PE header and check if the actual base address is different or does it something else?

Thank you :)

[cziter15]

If base address in PE is not equal to in-memory base address, that means that the module has been relocated.