Needless to say, this is a poorly written specification. Here are some of the questions you won't find an answer to.
- Endianness of the format. Is it always little-endian? (i.e. for big-endian machines as well?). Apparently, yes.
- Endianness of applying the relocation records. The base relocation record is obviously LE, but what about the modified VAs? I would assume target-endianness, but this isn't actually noted.
- Optional header checksum: what's the actual algorithm? I mean, it can't be any more interesting than a CRC32, and an *interested party* will obviously reverse engineer this, so you can't actually think that hiding such details is a security mechanism?
- What is the expected result of IMAGE_REL_BASED_HIGHADJ? Community consensus implies that the high value of the 32-bit word modified needs to be sign adjusted. Why not just say that in the specification?
- Why not list what base relocation types apply to what architectures?
I am sure there are more...