Hello stryker :)
Win9x supports any base >= 400000h.. so all you've to worry about is not going lower than that, and of course you should avoid also something extreme like ~70000000h.
Posted on 2002-06-24 16:41:59 by Maverick
try to run the same exe (with fixed value: 4000000h, not hinst) two times on win98.
Posted on 2002-06-25 14:02:59 by ti_mo_n

try to run the same exe (with fixed value: 4000000h, not hinst) two times on win98.


400000h not 4000000h :grin:
Posted on 2002-06-25 14:26:48 by bazik
Both 400000h and 4000000h work fine on 9x.
Tested: ran 2 instances of app with 400 0000h on 98.
without relocation.
Result: OK.
Posted on 2002-06-25 18:23:35 by The Svin
As long as we are picking a base address, maybe a more useful number should be used? 0C9C300h? 058C300h? I think I'll use 0C30000h. :grin:
Posted on 2002-06-25 18:57:15 by bitRAKE
thanks for the tests :) Now, I can put this aside.
Posted on 2002-06-25 21:24:49 by stryker
I would guess that if you picked a very low base, then you must retain relocation information.
Posted on 2002-06-25 21:35:56 by tenkey
On NT based OS's, down to 10000h ought to work ok.
On Win9x, as I already wrote, it must be >=400000h.

bitRAKE: alignment must be 10000h minimum, so no ????C300h, I'm afraid. ;)
Posted on 2002-06-26 02:10:25 by Maverick

bitRAKE: alignment must be 10000h minimum, so no ????C300h, I'm afraid. ;)
Bummer, guess I'll have to stick with 0C30000h. That way I can just to the stack and inbetween instruction - should really fool the disassemblers, but tracing will still be easy.
Posted on 2002-06-26 07:06:47 by bitRAKE
To fool disassemblers you should really crypt your code.

Runtime SMC "unfolding" is even better.
Posted on 2002-06-26 07:28:26 by Maverick
The more the marrier - thanks, Maverick. :)
Posted on 2002-06-26 08:02:20 by bitRAKE
what does relocating mean?
Posted on 2002-06-26 08:05:18 by nyook

what does relocating mean?
The absolute addresses are 'fixed' to allow execution at any address. This requires additional information to be store in the executable to know the offsets of addresses that need fixing.
Posted on 2002-06-26 08:39:24 by bitRAKE
What said that module handle must be an address of EXE in memory? The system should be able to restore this address from the handle, but it's possible, for example - because the addresses are always 4k aligned - to use the lowest 12 bits of module handle value for some additional module flags, etc.
Posted on 2002-06-26 14:00:58 by Tomasz Grysztar
As far as I know, microsoft doesn't guarantee anything about HANDLEs;
they are supposed to be opaque "objects" which shouldn't be used directly
in any way. Depending on your base address to be your HINSTANCE works for
now, and probably will in all windows versions, but there's no guarantee.

Or could you point me to an official article by microsoft that says otherwise?

At last, what is so awful by doing one single call to GetModuleHandle(NULL),
which no user will ever be able to feel? Even hutch seems to agree here :).

It's right what maverick says, 0x400000 should always be free for executable
loading (or else m$ will have serious trouble) - but there's still no guarantee
that your hinstance is your imagebase...

But oh well, if you want to be elitists, so be it.
Posted on 2002-06-27 13:24:49 by f0dder
Help! i'm in the dark... what is the significance of ????C300h other than the fact that C3 looks kinda like a guy with a big nose?
Posted on 2002-06-27 18:45:48 by jademtech
assuming hInstance is the address of your base image... can't you use



start: call @F
@@: pop eax
and eax,0FFFF0000h



or something similar?
The call should push the addr of @@ onto the stack, and the pop should put it into eax.

It works on my program

--Chorus
Posted on 2002-06-27 19:02:06 by chorus

Help! i'm in the dark... what is the significance of ????C300h other than the fact that C3 looks kinda like a guy with a big nose?
Actually, it's my girlfriend bent over. (The front end, not the back.) :tongue:
C3 is the retn instruction.
Posted on 2002-06-27 19:23:57 by bitRAKE
Couple of more questions re:HINSTANCE.

1) When I load up my program in OllyDebug, the initial state of the registers says EAX = 401000h i.e., the ptr to start. Is the debugger doing this, or is this how windows starts off your program? I tried using eax right off the bat and it didn't work...

2) If in your PE header you "prefer" your image base to be 400000h, don't all your items in .data etc, get hardcoded to this address. For example, if you disassemble or debug your app you see that mov hInstance,eax becomes mov [405580h],eax. Which is an absolute value. So if your program *was* loaded at a non-preferred location, wouldn't the app crash once you tried to move a dword to 405580h? After all, your data wouldn't be mapped to 405000h anymore (or wherever the linker decides it should go)

--Chorus
Posted on 2002-06-28 16:40:59 by chorus
2) ..not if you provide a valid reloc section.. then all those istances like [405580h] will be known, and will be relocated to the new address.

This is very common for DLL's.
Posted on 2002-06-28 17:14:34 by Maverick