Re: Editors
From: TS (nomailhere_at_deinmeister.de)
Date: 03/08/04
- Next message: TS: "Re: Registers"
- Previous message: Betov: "Re: Editors"
- In reply to: R.Wieser: "Re: Editors"
- Next in thread: R.Wieser: "Re: Editors"
- Reply: R.Wieser: "Re: Editors"
- Reply: Beth: "Re: Editors"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Mon, 08 Mar 2004 00:00:32 GMT
>> > Hmmm ... Than why do standard PE-files still have fix-up (aka :
>> > relocation) tables ... :-)
>>
>> For DLL Data only. (And, i suppose for PE type Drivers as well,
>> but i really do not know, actually).
>
>To be *really* sure, I just checked a few files. For some reason my quick
>inspection gives you right on Windows own executables, but not on
>executables I generated myself . Have to look into that one ....
It depends on the linker: Some include relocation info into all kinds
of PE files, some strip them on exe files by default. You may also
strip relocation info from DLLs, but only if you can be 100% sure that
there won´t be any overlap in linear address space.
>> A "normal PE" _never_ need relocation, -not considering DLL Data-,
>> and not considering an irregular default upload Address (provided,
>> in the PE Header, on purpose, to force the loader to relocate at
>> the proper Address)
Any default base address below 4MB will force relocation. I´m not sure
if someone also used an executable also as a DLL - I´ve seen some
executables which export addresses, but these were still the first PE
to be loaded into address space.
>As far as I know there is an entry that get's called whenever the DLL is
>loaded or unloaded by an app, as well when a new thread within that app is
>created or closed (all with the correct arguments ofcourse, like
>DLL_PROCESS_ATTACH). That gives the DLL to chance to create or release
>data-storage for that app or thread.
It´s the normal program entry point, the same as used for starting an
executable.
>So, the DLL does not have to be reloaded, just mapped into the callers
>code-space, and it will allocate what it needs for data-storage in that
>callers data-space.
Yes, but this also depends on the flags used in the PE sections.
Basically, duplicating pages only as soon as a write occurs is a good
memory preserving strategy...
- Next message: TS: "Re: Registers"
- Previous message: Betov: "Re: Editors"
- In reply to: R.Wieser: "Re: Editors"
- Next in thread: R.Wieser: "Re: Editors"
- Reply: R.Wieser: "Re: Editors"
- Reply: Beth: "Re: Editors"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|