关于Windows中.EXE的ImageBase [英] About ImageBase of .EXE in windows

问题描述

我刚刚得知ImageBase是用PE格式指定的，操作系统会将其加载到.EXE的确切位置，然后出现问题:

I just learned ImageBase is specified in PE format,and OS will load it to the exact position for .EXE , then comes the question:

如果两个.EXE需要相同的ImageBase位置怎么办?

what if two .EXE is requiring the same ImageBase location?

推荐答案

在2个EXE的情况下，它们具有完全不同的地址空间...每个可执行文件都有其自己的空间. 这意味着，每次执行EXE时，都会为它分配一个独立的4GB(在32位系统上，尽管该进程可以仅使用其中的一部分，而其余部分进入内核.)值得地址空间.它是虚拟地址空间.它不同于您的物理记忆.

Incase of 2 EXE's, they have Completely Different Address Spaces...Every Executable has its own space. This means, every time you execute an EXE, it is assigned its own independent 4GB (on 32bit systems, although the process can use just part of it, the rest goes the kernel.) worth address space. It's Virtual Address Space. It's different from your Physical Memory.

所以没有冲突.

从技术上讲，PE几乎可以在任何地方加载，但是默认 a> ImageBase是0x400000.

Technically, a PE can load just about anywhere, but the default ImageBase is 0x400000.

现在，假设您有一个EXE，并且它加载了几个DLL(恰好具有相同的ImageBase)...在这种情况下，第一个DLL加载正常，第二个DLL被重定位(或重新设置") ).每个DLL都有一个.reloc节，其中包含有关更新代码内引用的数据.

Now, Lets say you have an EXE and it loads a couple of DLL's (which happen to have the same ImageBase)...In this case, The first DLL loads fine, the second one gets relocated (or "rebased"). Each DLL has a .reloc Section which contains data about updating references within the code.

这篇关于关于Windows中.EXE的ImageBase的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！