If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even with ASLR, API calls in one process should always point to the same address as in any other process, as loading a section view at a different address will cause relocation fuckery. Can someone point me to a resource confirming this? I am using a very obtuse library injection technique and want to make sure I don’t need to resolve imports to use standard api calls.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.