RelocRipper

RelocRipper is a lightweight single purpose command line utility - remove the specified relocation entries from Windows Portable Executable (PE) files (both 32-bit and 64-bit) in the specified address range.

This tool is useful for reverse engineering, patching, or modifying executables where specific code or data sections should not be relocatable by the Windows loader (ASLR). This is particularly useful if you need to apply a patch over an instruction that has a relocation entry (e.g. overwriting a CALL instruction with a JMP or others), preventing the loader from corrupting your patch ("Byte is located in a relocation region" or similar).

How it Works

Instead of deleting entries and shifting the entire relocation table (which is problematic), RelocRipper nullifies (0x00) the target relocation entries by setting their type to IMAGE_REL_BASED_ABSOLUTE (0x00). The Windows loader ignores these entries, effectively "removing" the relocation without changing the file structure or size.

Features

• Precise Relocation Removal: Target specific ranges of code or data to exclude from relocation.
• Flexible Addressing: Supports specifying the target range using:
  • Absolute Virtual Address (default)
  • Relative Virtual Address (RVA)
  • File Offset
• Wide Compatibility: Works with both PE32 (x86) and PE32+ (x64) binaries.
• In-Place Modification: Directly patches the specified file (make sure you have backups!).

Usage

reloc-ripper.exe <file.exe> <address> [size] [type]

Arguments

• <file.exe>: Path to the target PE file.
• <address>: The starting address of the range. Can be decimal or hex (just prefix with 0x).
  • Prefixes rva: or file: can be used to override the type.
• [size]: (Optional) Size of the range to clear relocations for. Default is 1 byte.
• [type]: (Optional) Explicitly specify the address type:
  • abs / absolute: Absolute Virtual Address (e.g., 0x00401000)
  • rva / relative: Relative Virtual Address (e.g., 0x1000)
  • file / offset: Raw File Offset (e.g., 0x400)

Examples

1. Remove relocations for a specific function at absolute address 0x00401200 with size 0x50:

reloc-ripper.exe target.exe 0x00401200 0x50

2. Remove relocations using an RVA:

reloc-ripper.exe target.exe 0x1200 0x50 rva
# OR
reloc-ripper.exe target.exe rva:0x1200 0x50

3. Remove relocations based on a file offset:

reloc-ripper.exe target.exe 0x600 0x20 file
# OR
reloc-ripper.exe target.exe file:0x600 0x20

Compilation

You can compile this tool using GCC (MinGW) or MSVC.

Using GCC:

gcc reloc-ripper.c -o reloc-ripper.exe

Using MSVC (Developer Command Prompt):

cl reloc-ripper.c /Fe:reloc-ripper.exe

Disclaimer

WARNING: This tool modifies binary files in place. Removing relocations incorrectly can corrupt the executable or cause it to crash at runtime, especially if ASLR is enabled. ALWAYS BACK UP YOUR FILES BEFORE USING THIS TOOL.

License

Open Source (MIT License), check the LICENSE file. Use at your own risk.