Neither options you indicated entirely correct/true.
This excellent tutorial on How to inject code in a PE file shows that the actual IMAGE_BASE_RELOCATION
structure is:
typedef struct _IMAGE_BASE_RELOCATION {
DWORD VirtualAddress;
DWORD SizeOfBlock;
} IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION;
Section 5.2 of this Microsoft Portable Executable and Common Object File Format Specification describe the structure. The SizeOfBlock-8
actually indicates how many WORD TypeOffset
follow after the VirtualAddress
and SizeOfBlock
.
I think you would also be interested in Table 7 of the tutorial, which shows the structure of the blocks from the relocation table. I'll copy-paste the table here for quick-reference.