Like Tree2Likes
  • 1 Post By brewbuck
  • 1 Post By brewbuck

The concept of preferred base address in PE File

This is a discussion on The concept of preferred base address in PE File within the Windows Programming forums, part of the Platform Specific Boards category; I'm now reading the PE FILE SPEC. "RVA" "VA" "BaseAddress" "Preferred base address", I can't figure them out. Thx in ...

  1. #1
    Registered User icefight's Avatar
    Join Date
    Mar 2013
    Posts
    7

    The concept of preferred base address in PE File

    I'm now reading the PE FILE SPEC. "RVA" "VA" "BaseAddress" "Preferred base address", I can't figure them out.
    Thx in advance.

  2. #2
    Captain Crash brewbuck's Avatar
    Join Date
    Mar 2007
    Location
    Portland, OR
    Posts
    7,272
    VA: Virtual address. The location of an object in virtual memory
    RVA: Relative virtual address. The location of an object, relative to the base address
    Base address: The virtual address at which a DLL is loaded
    Preferred base address: The virtual address at which a DLL should be loaded if no relocations are to be performed

    Example. foobar.dll has a preferred base address of 0x78000000. If the DLL is loaded at that particular address, then no relocation processing is necessary. If it loads at some non-preferred address (for instance, because something else is already located at 0x78000000), then the runtime linker will need to perform relocations. Suppose there is a variable inside the DLL, which is located at an RVA of 0x1000. This means that it has a VA of base_address + 0x1000. If the DLL was loaded at the preferred base, this address will be 0x78000000 + 0x1000 == 0x78001000. Otherwise, it will be at some other address.

    DLLs are always loaded at an address which is a multiple of 64k -- that is, the last four digits of the base address are always zero, even if loaded in a non-preferred location.
    icefight likes this.
    Code:
    //try
    //{
    	if (a) do { f( b); } while(1);
    	else   do { f(!b); } while(1);
    //}

  3. #3
    Registered User icefight's Avatar
    Join Date
    Mar 2013
    Posts
    7
    That's impressive. Thanks very much.

  4. #4
    Registered User icefight's Avatar
    Join Date
    Mar 2013
    Posts
    7
    I read the PE File spec again and I found this:

    IMAGE_FILE_RELOCS_STRIPPED 0x0001 Image only, Windows CE, Windows NT and above. Indicates that the file does not contain base relocations and must therefore be loaded at its preferred base address. If the base address is not available, the loader reports an error. Operating systems running on top of MS-DOS (Win32s™) are generally not able to use the preferred base address and so cannot run these images. However, beginning with version 4.0, Windows will use an application’s preferred base address. The default behavior of the linker is to strip base relocations from EXEs.

  5. #5
    Registered User icefight's Avatar
    Join Date
    Mar 2013
    Posts
    7
    Microsoft Portable Executable and Common Object File Format Specification
    Microsoft Corporation
    Revision 6.0 - February 1999

  6. #6
    Registered User icefight's Avatar
    Join Date
    Mar 2013
    Posts
    7
    What's the mean of this "Indicates that the file does not contain base relocations"? if the file contains, where could i find it!

  7. #7
    Registered User icefight's Avatar
    Join Date
    Mar 2013
    Posts
    7
    foobar.dll has a preferred base address of 0x78000000. You mean that the address of 0x78000000 is the address in the virtual memory space specified by the loader?

  8. #8
    Captain Crash brewbuck's Avatar
    Join Date
    Mar 2007
    Location
    Portland, OR
    Posts
    7,272
    Quote Originally Posted by icefight View Post
    What's the mean of this "Indicates that the file does not contain base relocations"? if the file contains, where could i find it!
    The relocations are contained in the RELOC section. You can see it by dumping the section headers with the dumpbin utility. If the IMAGE_FILE_RELOCS_STRIPPED flag is set, it means this section does not exist. Without the reloc section, the loader cannot load the DLL at a non-preferred base address (because it doesn't know how to do the required fixups).

    foobar.dll has a preferred base address of 0x78000000. You mean that the address of 0x78000000 is the address in the virtual memory space specified by the loader?
    It is the DLL which specifies that number. The loader simply looks at that and tries to put the DLL in that location. If it can't, it will have to perform relocations.
    icefight likes this.
    Code:
    //try
    //{
    	if (a) do { f( b); } while(1);
    	else   do { f(!b); } while(1);
    //}

  9. #9
    Registered User icefight's Avatar
    Join Date
    Mar 2013
    Posts
    7
    Oh,I get it.
    Thanks very much,brewbuck.
    I appreciate your helping me.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. help file concept
    By helloworld28 in forum C Programming
    Replies: 5
    Last Post: 04-01-2011, 11:25 AM
  2. A way to automatically detect the base address of a PCI card
    By binaryboy in forum Windows Programming
    Replies: 4
    Last Post: 11-17-2009, 08:28 AM
  3. base address of a simple array
    By nacho4d in forum C Programming
    Replies: 13
    Last Post: 04-07-2008, 02:28 PM
  4. I want to get base address of PCI board
    By Syrius in forum Windows Programming
    Replies: 11
    Last Post: 10-10-2007, 07:09 AM
  5. module base address
    By cppdude in forum Windows Programming
    Replies: 2
    Last Post: 03-29-2002, 06:14 PM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21