2

If I load a dll in 2 different processes, will the offsets calculations within one process hold for the other process?

I'm currently trying to patch the import table of a dll, once injected into a remote process. I was wondering if I could LoadLibrary and GetProcAddress in the injector process and simply math an expected location in the target process based on the address where the dll is loaded.

1
  • non relocatable address will be same in all loaded instances of your dll relocatable address will have differnt base based on where it is loaded
    – blabb
    Nov 2 '20 at 18:09
3

Yes. Executable relocations, whether performed for optimization or security, will only relocate the image (executable, shared object) as a whole.

For that reason, to bypass ASLR for example, any single address within a chosen shared object is sufficient. Given, of course, you know the precise version and build of the shared object. Knowing the specific build might be an issue by itself, however.

The reason relocations are done at the shared object level (and not, say, the function level) is because a shared object often has many internal relative references. Those are references that are addressed relatively (and not absolutely) within a single shared object.

In order to relocate at a lower level, many more relocation fixes will be required of the loader.

Moreover, and this is more of a historic reason than a technological one, relocations were intended to solve a problem with sharing an address space between multiple shared objects. There was simply no need to do more than change the location of a module altogether. The same base properties were later used for enabling ASLR.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.