A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about user-mode development.
 #25160  by Stylo
 Thu Feb 05, 2015 9:51 am
Hi,
Just wondered about something . .
how does windbg can tell when a modules has been relocated using the command !imgreloc ?
is it depends of the preferred address that is inside the PE header and check if the actual base address is different or does it something else?

Thank you :)