How binding executable have in-memory address of api imported from other Dll? -
i'm reading binding encounter line.
"the executable file on disk has actual in-memory addresses of apis in other dlls in iat. when loading bound executable."
dlls can't load @ same address location in memory. please explain me how binding executable have in-memory address.
thanks
it preferred address , depends on windows service packs , versions,... if dll not loaded @ preferred address or timedatestamp mismatches, it'll use arbitrary iat loading.
binding has no effect if address space layout randomization (aslr) enabled image using /dynamicbase on versions of windows support aslr.
Comments
Post a Comment