windowsportable-executable

What is the image base (in windows PE files)


I read the documentation about the PE format on MSDN, there it specifies:

The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000, Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000

I don't quite understand this. What is a "preferred address"? How is this field used by windows when making a new process/loading an executable?


Solution

  • It is the address in virtual memory where the executable should be loaded at to avoid any adjustment of absolute jump instructions in the code. The OS may load the module to a different address (in case e.g., 2 DLLs needed by the same program have the same image base), but in that case, the code needs to be patched when loaded.

    For more info, see https://learn.microsoft.com/en-us/previous-versions/ms809762(v=msdn.10) (search for ImageBase there).