I have a quick question related to the Image Base Addresses of PE Modules.
Is it correct, that when windows loads a new process into memory, that the executable pe module (the .exe file itself) is loaded into memory first, and after that, the dlls (which have to be loaded) are loaded into its address space.
If that is correct, the .exe pe modules are always loaded at the Image Base Address specified in the PE Module in the Optional Header, because it's the first module to be loaded, so another module cannot be loaded in this address range alreay. is that correct?
But .dll modules might not be loaded at the desired Image Base specified in the pe module because if there are for example 2 dlls which have to be loaded into the same address space at the same Image Base, 1 dll will have to be loaded at another address so that they don't "overlap" each other. is that correct?
Posted on 2001-09-17 09:06:24 by darester
yes, windows loads first the exe, than all dlls

exe is loaded normally to its base address, f.e. 400000h
the docu says, that its "possible", that the exe must be
relocated elsewhere, but I could never create this case.
At least under Win95 the exe could always be loaded to
its base address.

DLLs become relocated, if the target address space is already
in use. So your statements are all correct :)
Posted on 2001-09-17 09:21:20 by beaster