"fake" PE... it's no wonder it works this way.
base is BC570000, abort PC is BC570D34. take you "fake" PE and look at
the offset of D34 (or 0xD34 - 0x138 from the .text), what it does.
it's hard to say, it can be anything. it's a broken image, what do you
expect? it's 32 bit ARM and not a single relocation? really? you do
have .data section? so, say, there is some variable X in the data
section. your code references it, and, on 32 bit ARM literal pool
pointers are accessed a PC relative way, but the pointer to X itself
is NOT. where the relocation for it? it's NULL. here, enough reason to
abort, - dereferencing inaccessible address.
LDR r6, [pc, #(LP_X - . - 8)] @ this way r6, holds X address and
can reference it
LiteralPool @ it's inside .text section
LP_X: .long X @ X resides inside .data, and LP_X holds its address,
@ it's a subject for base relocations
virtual size of text section is LESS than the size of raw data...
section alignment is 0x20. why?
using appropriate compilers could save you from getting "desperate".