0

In part 3 of lena RE tutorial, i see a word : imagebase

Can anyone tell me more about this and better meaning of this word?

enter image description here

2

From Microsoft docs:

The preferred address of the first byte of image when loaded into memory [...] The default for DLLs is 0x10000000. [...] The default for Windows NT, Windows 2000, Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000

So, in case of exe, you can usually expect that it will be loaded at 0x400000 address and when you load the dll, it is loaded at 0x10000000 by default. All these values correspond only to particular process' virtual memory.

PE files may have different image bases than the default ones. So if a dll has ImageBase = 0x20000000, you can expect it to be loaded at this address instead. Note however, that it is only the preferred address - it may be changed if, for example, second dll that is loaded into the same process already occupies this space.

If you have any more doubts regarding PE format, you can either follow the docs linked above or slightly more compact description here.

6
  • Nice, Thank you for Complete explanations. But what is image bases means? My English is weak. i don't know What is the meaning of this word. What does it refer to?
    – Jason
    Jul 7 at 18:19
  • It's just the address where the first byte of PE file is loaded into memory when the process is started.
    – bart1e
    Jul 7 at 18:22
  • Thank you very much. Does this word have another synonym? (imagebase) I know this word only means photo. My English is weak
    – Jason
    Jul 7 at 18:30
  • 1
    “ImageBase” is just a name of a member of a structure (‘OptionalHeader’ to be precise). It consists of two words: image and base. The word “image” here refers to the executable loaded into memory.
    – bart1e
    Jul 7 at 18:42
  • well when windows loads a file into memory it creates a map or in other words an image of the file the base address where it started mapping is the image base address like the fourth photo on the wall from left side is photo of my xyz like wise
    – blabb
    Jul 7 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.