Thread: The concept of preferred base address in PE File

VA: Virtual address. The location of an object in virtual memory
RVA: Relative virtual address. The location of an object, relative to the base address
Base address: The virtual address at which a DLL is loaded
Preferred base address: The virtual address at which a DLL should be loaded if no relocations are to be performed

Example. foobar.dll has a preferred base address of 0x78000000. If the DLL is loaded at that particular address, then no relocation processing is necessary. If it loads at some non-preferred address (for instance, because something else is already located at 0x78000000), then the runtime linker will need to perform relocations. Suppose there is a variable inside the DLL, which is located at an RVA of 0x1000. This means that it has a VA of base_address + 0x1000. If the DLL was loaded at the preferred base, this address will be 0x78000000 + 0x1000 == 0x78001000. Otherwise, it will be at some other address.

DLLs are always loaded at an address which is a multiple of 64k -- that is, the last four digits of the base address are always zero, even if loaded in a non-preferred location.

Originally Posted by icefight

What's the mean of this "Indicates that the file does not contain base relocations"? if the file contains, where could i find it!

The relocations are contained in the RELOC section. You can see it by dumping the section headers with the dumpbin utility. If the IMAGE_FILE_RELOCS_STRIPPED flag is set, it means this section does not exist. Without the reloc section, the loader cannot load the DLL at a non-preferred base address (because it doesn't know how to do the required fixups).

foobar.dll has a preferred base address of 0x78000000. You mean that the address of 0x78000000 is the address in the virtual memory space specified by the loader?

It is the DLL which specifies that number. The loader simply looks at that and tries to put the DLL in that location. If it can't, it will have to perform relocations.