DLL preferred load address

[anminxin]

HMODULE hModule=LoadLibrary("Drive:\\folder\\sth.dll"); if(!hModule) { MessageBox("Load sth.dll failed!); return; } FARPROC address= GetProcAddress(hModule, ("Drive:\\folder\\sth.dll"); if(!address) { MessageBox("GetProcAddress failed!); return; }

[George_George]

Hi Simon, Which Window in Process Explorer lists loaded DLLs for a process? I can not find out. :-) regards, George

[George_George]

Hi Iain, Here is my output, which item do you think is the preferred load address? :-)

Microsoft (R) COFF/PE Dumper Version 9.00.30729.01
Copyright (C) Microsoft Corporation. All rights reserved.

Dump of file TestDll2.dll

PE signature found

File Type: DLL

FILE HEADER VALUES
8664 machine (x64)
7 number of sections
48FF2B43 time date stamp Wed Oct 22 21:31:47 2008
0 file pointer to symbol table
0 number of symbols
F0 size of optional header
2022 characteristics
Executable
Application can handle large (>2GB) addresses
DLL

OPTIONAL HEADER VALUES
20B magic # (PE32+)
9.00 linker version
4800 size of code
3600 size of initialized data
0 size of uninitialized data
1520 entry point (0000000180001520) _DllMainCRTStartup
1000 base of code
180000000 image base (0000000180000000 to 000000018000CFFF)
1000 section alignment
200 file alignment
5.02 operating system version
0.00 image version
5.02 subsystem version
0 Win32 version
D000 size of image
400 size of headers
F212 checksum
2 subsystem (Windows GUI)
140 DLL characteristics
Dynamic base
NX compatible
100000 size of stack reserve
1000 size of stack commit
100000 size of heap reserve
1000 size of heap commit
0 loader flags
10 number of directories
7DB0 [ 16A] RVA [size] of Export Directory
A000 [ 3C] RVA [size] of Import Directory
B000 [ 2B8] RVA [size] of Resource Directory
9000 [ 288] RVA [size] of Exception Directory
0 [ 0] RVA [size] of Certificates Directory
C000 [ 3C] RVA [size] of Base Relocation Directory
6550 [ 1C] RVA [size] of Debug Directory
0 [ 0] RVA [size] of Architecture Directory
0 [ 0] RVA [size] of Global Pointer Directory
0 [ 0] RVA [size] of Thread Storage Directory
0 [ 0] RVA [size] of Load Configuration Directory
0 [ 0] RVA [size] of Bound Import Directory

[George_George]

Hi anminxin, Sorry I disagree with your code. I am asking how to get the preferred load address, but you get the actual load address. Any comments? regards, George

[Naveen]

From the view menus, select the "Show lower pane options" Then again from the view menu select "view->Lower pane view->dll"

nave [OpenedFileFinder] [My Blog]

[George_George]

Thanks nave, DLL is displayed, but the DLL properties only display load address, no preferred load address. Any comments? regards, George

[Naveen]

You can select that column also. take the select column option by right clicking on the header of the lower pane. Select the "Base" and "Image Base" from the list. The "base" is the address at which the dll has actually loaded and "Image base" is the prefered base address. You can also use the dependency walker to find the prefered base address.

nave [OpenedFileFinder] [My Blog]

[George_George]

Thanks nave! I have found out, very good tool! :-) regards, George

[Simon P Stevens]

This one:

   180000000 image base (0000000180000000 to 000000018000CFFF)

Simon

[Iain Clarke Warrior Programmer]

George_George wrote:

Here is my output, which item do you think is the preferred load address?

In the middle of the first "Lump":

180000000 image base (0000000180000000 to 000000018000CFFF)

Though I'd look at the sysinternals tool, as they're more digestible! Iain.

[George_George]

Thanks for your clarification, Simon! regards, George

[George_George]

Thanks for sharing your perspective, Iain! regards, George