I currently try to figure out, what actually happens to a
PE File in memory. To reword it: How could
PE files differ, when they run on different computers and what are the mutable parts of a PE file, when they are loaded into memory?
My overall goal is to understand, what a normalization process of memory dumps of specific processes could look like (as mentioned here for example).
My understanding so far:
- Sections getting mapped to different locations
- Sections get page-aligned
- IAT gets updated
- Base relocations are performed
Did I miss anything?