If you take an exe file and disassemble it (for example, through IDA PRO), you can see the so-called virtual addresses. How does the compiler arrange these addresses?

  • Know this uncle - Chris Kaspersky? Look at his literature, there, for sure, you will find many interesting things. - isnullxbh

1 answer 1

A Windows user program does not have access to physical addresses in memory, only virtual ones.

If we talk about tools: the compiler does not assign addresses in any way, it creates an object file with empty fields, where the linker will already register actual virtual addresses or deltas for transitions.

Traditionally (and, apparently, for compatibility with older versions of Windows), the base virtual address for executables is chosen to be 0x400000, for dynamic libraries - like, 0x1000000. But the Windows executable file loader can easily load both the executable and the library at a completely different address. To fix the fixed addresses in the executable file / library, they have the so-called "relocation table" ( relocation table , relocation table ), which shows the places in the executable file, where absolute virtual addresses are written. Such addresses are increased by the difference between the original base address (written in the file) and the actual base address (at which this file is trying to place the loader).

Additional Information:

  • Tell me where can I find information about memory ..? how to put the code and data (not in general, but specifically, with a detailed description) and how it all works. - Vadimcg