exeportable-executable

About ImageBase of .EXE in windows


I just learned ImageBase is specified in PE format,and OS will load it to the exact position for .EXE , then comes the question:

what if two .EXE is requiring the same ImageBase location?


Solution

  • In case of 2 EXE's, they have completely different address spaces. Every executable has its own space. This means, every time you execute an EXE, it is assigned its own independent 4GB (on 32bit systems, although the process can use just part of it, the rest goes the kernel) worth address space. It's Virtual Address Space. It's different from your physical memory.

    So, there's no conflict.

    Technically, a PE can load just about anywhere, but the default ImageBase is 0x400000.

    Now, let's say you have an EXE and it loads a couple of DLL's (which happen to have the same ImageBase)...In this case, The first DLL loads fine, the second one gets relocated (or "rebased"). Each DLL has a .reloc Section which contains data about updating references within the code.