Force a module (DLL) to be loaded at a specific addressHow do you disable ASLR (address space layout randomization) on Windows 7 x64?SOS commands fail while live debugging a process which has multiple versions of CLR loadedHow do I debug around module overlap in windbg using SOS?Manually setting breakpoints in WinDBGModify function contents at runtime with WinDbgPinning a DLL in memory (increase reference count)Attach to specific process using IDA + WINDBG in kernel debuggingHow to avoid ChildEBP and RetAddr in WinDbg call stack?In WinDbg commands, how can I refer to a register with the same name as a global variable?WinDbg/SOS: Is it possible to highlight the source line in managed code when a breakpoint is hit?How to do hybrid user-mode/kernel-mode debugging?
Why isn't "I've" a proper response?
What verb is かまされる?
Why did Khan ask Admiral James T. Kirk about Project Genesis?
Compelling story with the world as a villain
Round towards zero
How to find out the average duration of the peer-review process for a given journal?
Murderer's Gloves, which book is it from?
Nothing like a good ol' game of ModTen
Why do banks “park” their money at the European Central Bank?
Is MOSFET active device?
How would a Creature that needs to be seen by Humans evolve?
Would it be possible to have a GMO that produces chocolate?
Is there any practical application for performing a double Fourier transform? ...or an inverse Fourier transform on a time-domain input?
Was there ever a treaty between 2 entities with significantly different translations to the detriment of one party?
Can RMSE and MAE have the same value?
Change my first, I'm entertaining
Papers on arXiv solving the same problem at the same time
How do proponents of Sola Scriptura address the ministry of those Apostles who authored no parts of Scripture?
How do I make my image comply with the requirements of this photography competition?
Arduino oscilloscope voltage divider design
Read file lines into shell line separated by space
Can a Rogue PC teach an NPC to perform Sneak Attack?
'Us students' - Does this apposition need a comma?
Are the A380 engines interchangeable (given they are not all equipped with reverse)?
Force a module (DLL) to be loaded at a specific address
How do you disable ASLR (address space layout randomization) on Windows 7 x64?SOS commands fail while live debugging a process which has multiple versions of CLR loadedHow do I debug around module overlap in windbg using SOS?Manually setting breakpoints in WinDBGModify function contents at runtime with WinDbgPinning a DLL in memory (increase reference count)Attach to specific process using IDA + WINDBG in kernel debuggingHow to avoid ChildEBP and RetAddr in WinDbg call stack?In WinDbg commands, how can I refer to a register with the same name as a global variable?WinDbg/SOS: Is it possible to highlight the source line in managed code when a breakpoint is hit?How to do hybrid user-mode/kernel-mode debugging?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
- An executable is loaded and run in WinDbg
- It loads modules it needs at certain addresses
- Breakpoints set/traces retrieved in this session depend on these addresses
- When another session is started for the same executable, (either depending the on the code execution path changing dll dependency order, or some indeterministic loader behavior?) the modules are now loaded into different addresses.
It would have been helpful if there was a way to instruct windbg/loader to load the not-yet-loaded modules at given addresses. This would make certain scripts/text-comparisons much easier.
Yes, I do realize that for example, setting breakpoints relative to symbol names should be preferred instead of using fixed addreses, but being able to "reproduce" a reference debugging environment definitely has certain advantages.
Assuming we're dealing with 3rd party DLLs (that I cannot recompile with predefined loading addresses), is there a way to do this?
I was so happy to see .reload command has an address parameter, which looked like it would do exactly what I'm asking. However, even though that command would load the modules, when the program is continued (and the actual dll load is needed), it would go ahead and still load another copy(?) for the same module, and give a warning like:
WARNING: moduleX_1be0000 overlaps moduleX
So it didn't really work like I expected, thus this question!
windbg
asked Mar 27 at 17:46
OzgurHOzgurH
3301 silver badge8 bronze badges
add a comment |
- An executable is loaded and run in WinDbg
- It loads modules it needs at certain addresses
- Breakpoints set/traces retrieved in this session depend on these addresses
- When another session is started for the same executable, (either depending the on the code execution path changing dll dependency order, or some indeterministic loader behavior?) the modules are now loaded into different addresses.
It would have been helpful if there was a way to instruct windbg/loader to load the not-yet-loaded modules at given addresses. This would make certain scripts/text-comparisons much easier.
Yes, I do realize that for example, setting breakpoints relative to symbol names should be preferred instead of using fixed addreses, but being able to "reproduce" a reference debugging environment definitely has certain advantages.
Assuming we're dealing with 3rd party DLLs (that I cannot recompile with predefined loading addresses), is there a way to do this?
I was so happy to see .reload command has an address parameter, which looked like it would do exactly what I'm asking. However, even though that command would load the modules, when the program is continued (and the actual dll load is needed), it would go ahead and still load another copy(?) for the same module, and give a warning like:
WARNING: moduleX_1be0000 overlaps moduleX
So it didn't really work like I expected, thus this question!
windbg
asked Mar 27 at 17:46
OzgurHOzgurH
3301 silver badge8 bronze badges
add a comment |
- An executable is loaded and run in WinDbg
- It loads modules it needs at certain addresses
- Breakpoints set/traces retrieved in this session depend on these addresses
- When another session is started for the same executable, (either depending the on the code execution path changing dll dependency order, or some indeterministic loader behavior?) the modules are now loaded into different addresses.
It would have been helpful if there was a way to instruct windbg/loader to load the not-yet-loaded modules at given addresses. This would make certain scripts/text-comparisons much easier.
Yes, I do realize that for example, setting breakpoints relative to symbol names should be preferred instead of using fixed addreses, but being able to "reproduce" a reference debugging environment definitely has certain advantages.
Assuming we're dealing with 3rd party DLLs (that I cannot recompile with predefined loading addresses), is there a way to do this?
I was so happy to see .reload command has an address parameter, which looked like it would do exactly what I'm asking. However, even though that command would load the modules, when the program is continued (and the actual dll load is needed), it would go ahead and still load another copy(?) for the same module, and give a warning like:
WARNING: moduleX_1be0000 overlaps moduleX
So it didn't really work like I expected, thus this question!
windbg
asked Mar 27 at 17:46
OzgurHOzgurH
3301 silver badge8 bronze badges
- An executable is loaded and run in WinDbg
- It loads modules it needs at certain addresses
- Breakpoints set/traces retrieved in this session depend on these addresses
- When another session is started for the same executable, (either depending the on the code execution path changing dll dependency order, or some indeterministic loader behavior?) the modules are now loaded into different addresses.
It would have been helpful if there was a way to instruct windbg/loader to load the not-yet-loaded modules at given addresses. This would make certain scripts/text-comparisons much easier.
Yes, I do realize that for example, setting breakpoints relative to symbol names should be preferred instead of using fixed addreses, but being able to "reproduce" a reference debugging environment definitely has certain advantages.
Assuming we're dealing with 3rd party DLLs (that I cannot recompile with predefined loading addresses), is there a way to do this?
I was so happy to see .reload command has an address parameter, which looked like it would do exactly what I'm asking. However, even though that command would load the modules, when the program is continued (and the actual dll load is needed), it would go ahead and still load another copy(?) for the same module, and give a warning like:
WARNING: moduleX_1be0000 overlaps moduleX
So it didn't really work like I expected, thus this question!
windbg
windbg
asked Mar 27 at 17:46
OzgurHOzgurH
3301 silver badge8 bronze badges
asked Mar 27 at 17:46
OzgurHOzgurH
3301 silver badge8 bronze badges
asked Mar 27 at 17:46
OzgurHOzgurH
3301 silver badge8 bronze badges
asked Mar 27 at 17:46
OzgurHOzgurH
3301 silver badge8 bronze badges
asked Mar 27 at 17:46
OzgurHOzgurH
3301 silver badge8 bronze badges
3301 silver badge8 bronze badges
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
WinDbg does not load modules (DLLs). The modules are loaded by the executable.
The ld and .reload commands of WinDbg do not load modules, they load symbol information (PDB files).
The process of changing the address of a module is called rebasing. It happens if the base address is not available any more, e.g. in use by a heap already. In that case, you cannot prevent rebasing at all.
One thing that might help is disabling ASLR (address space layout randomization). You can change that setting in a DLL or EXE. It's part of the COFF header:
On Windows 7, there were ways to disable ASLR completely, but it's not recommended to change that setting on a per-system basis just to help you debug a single process.
Another option would be to use rebase.exe of the Windows SDK and change the base address to a virtual address that you think is more likely to be free at the time the DLL is loaded. I never did that myself, but the rebase help says:
If you want to rebase to a fixed address (ala QFE)
use the @@files.txt format where files.txt contains
address/size combos in addition to the filename
so, it sounds possible to define your own address.
answered Mar 27 at 21:33
Thomas WellerThomas Weller
31.1k11 gold badges78 silver badges149 bronze badges
Checking the options, yes, I've also realized the main purpose of.reloadhad to do with symbols, but the official help page for it specifically says:In some cases, this command also reloads or unloads the module itself. The existence address parameter wouldn't have made much sense otherwise I think.
– OzgurH
Mar 27 at 21:51
As for ASLR, I did see the post in SO RE that was titled rather similar to mine, which in turn pointed me to the one you've linked. I was just trying that system-wide setting (through EMET), and it royally messed up the system. The debugger target was not working, and it was also causing problems with other applications in my case. I did also researched into rebasing options. The pages said that MS'srebase(does not take base address as parameter, and) sets it based on file name/hash , so it wouldn't quite guarantee clash-free base address, do you know if that's still the case?
– OzgurH
Mar 27 at 22:03
@OzgurH: it's possible that messing with ASLR in Windows >7 may cause problems. Indeed some people say there are problems in Win 8.1 already: digital-forensics.sans.org/blog/2014/02/17/… I've updated the answer regarding the fixed base address. Seems rather complicated.
– Thomas Weller
Mar 27 at 22:11
I was hoping for more of a virtual/on-the-fly/non-intrusive kind of resolution to be honest. However, if no other answer shows up in the next couple of days, I'll try out both rebase, and PE editing suggestions to see if they achieve what I'm after........ (Thanks for quick response/edit for my comment! - rebase may work after all (assuming ASLR doesn't always win!?)) (BTW, have you noticed my answer to your 5+ year old question (#20515857)? :) )
– OzgurH
Mar 27 at 22:18
add a comment |
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55383561%2fforce-a-module-dll-to-be-loaded-at-a-specific-address%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
WinDbg does not load modules (DLLs). The modules are loaded by the executable.
The ld and .reload commands of WinDbg do not load modules, they load symbol information (PDB files).
The process of changing the address of a module is called rebasing. It happens if the base address is not available any more, e.g. in use by a heap already. In that case, you cannot prevent rebasing at all.
One thing that might help is disabling ASLR (address space layout randomization). You can change that setting in a DLL or EXE. It's part of the COFF header:
On Windows 7, there were ways to disable ASLR completely, but it's not recommended to change that setting on a per-system basis just to help you debug a single process.
Another option would be to use rebase.exe of the Windows SDK and change the base address to a virtual address that you think is more likely to be free at the time the DLL is loaded. I never did that myself, but the rebase help says:
If you want to rebase to a fixed address (ala QFE)
use the @@files.txt format where files.txt contains
address/size combos in addition to the filename
so, it sounds possible to define your own address.
answered Mar 27 at 21:33
Thomas WellerThomas Weller
31.1k11 gold badges78 silver badges149 bronze badges
Checking the options, yes, I've also realized the main purpose of.reloadhad to do with symbols, but the official help page for it specifically says:In some cases, this command also reloads or unloads the module itself. The existence address parameter wouldn't have made much sense otherwise I think.
– OzgurH
Mar 27 at 21:51
As for ASLR, I did see the post in SO RE that was titled rather similar to mine, which in turn pointed me to the one you've linked. I was just trying that system-wide setting (through EMET), and it royally messed up the system. The debugger target was not working, and it was also causing problems with other applications in my case. I did also researched into rebasing options. The pages said that MS'srebase(does not take base address as parameter, and) sets it based on file name/hash , so it wouldn't quite guarantee clash-free base address, do you know if that's still the case?
– OzgurH
Mar 27 at 22:03
@OzgurH: it's possible that messing with ASLR in Windows >7 may cause problems. Indeed some people say there are problems in Win 8.1 already: digital-forensics.sans.org/blog/2014/02/17/… I've updated the answer regarding the fixed base address. Seems rather complicated.
– Thomas Weller
Mar 27 at 22:11
I was hoping for more of a virtual/on-the-fly/non-intrusive kind of resolution to be honest. However, if no other answer shows up in the next couple of days, I'll try out both rebase, and PE editing suggestions to see if they achieve what I'm after........ (Thanks for quick response/edit for my comment! - rebase may work after all (assuming ASLR doesn't always win!?)) (BTW, have you noticed my answer to your 5+ year old question (#20515857)? :) )
– OzgurH
Mar 27 at 22:18
add a comment |
WinDbg does not load modules (DLLs). The modules are loaded by the executable.
The ld and .reload commands of WinDbg do not load modules, they load symbol information (PDB files).
The process of changing the address of a module is called rebasing. It happens if the base address is not available any more, e.g. in use by a heap already. In that case, you cannot prevent rebasing at all.
One thing that might help is disabling ASLR (address space layout randomization). You can change that setting in a DLL or EXE. It's part of the COFF header:
On Windows 7, there were ways to disable ASLR completely, but it's not recommended to change that setting on a per-system basis just to help you debug a single process.
Another option would be to use rebase.exe of the Windows SDK and change the base address to a virtual address that you think is more likely to be free at the time the DLL is loaded. I never did that myself, but the rebase help says:
If you want to rebase to a fixed address (ala QFE)
use the @@files.txt format where files.txt contains
address/size combos in addition to the filename
so, it sounds possible to define your own address.
answered Mar 27 at 21:33
Thomas WellerThomas Weller
31.1k11 gold badges78 silver badges149 bronze badges
Checking the options, yes, I've also realized the main purpose of.reloadhad to do with symbols, but the official help page for it specifically says:In some cases, this command also reloads or unloads the module itself. The existence address parameter wouldn't have made much sense otherwise I think.
– OzgurH
Mar 27 at 21:51
As for ASLR, I did see the post in SO RE that was titled rather similar to mine, which in turn pointed me to the one you've linked. I was just trying that system-wide setting (through EMET), and it royally messed up the system. The debugger target was not working, and it was also causing problems with other applications in my case. I did also researched into rebasing options. The pages said that MS'srebase(does not take base address as parameter, and) sets it based on file name/hash , so it wouldn't quite guarantee clash-free base address, do you know if that's still the case?
– OzgurH
Mar 27 at 22:03
@OzgurH: it's possible that messing with ASLR in Windows >7 may cause problems. Indeed some people say there are problems in Win 8.1 already: digital-forensics.sans.org/blog/2014/02/17/… I've updated the answer regarding the fixed base address. Seems rather complicated.
– Thomas Weller
Mar 27 at 22:11
I was hoping for more of a virtual/on-the-fly/non-intrusive kind of resolution to be honest. However, if no other answer shows up in the next couple of days, I'll try out both rebase, and PE editing suggestions to see if they achieve what I'm after........ (Thanks for quick response/edit for my comment! - rebase may work after all (assuming ASLR doesn't always win!?)) (BTW, have you noticed my answer to your 5+ year old question (#20515857)? :) )
– OzgurH
Mar 27 at 22:18
add a comment |
WinDbg does not load modules (DLLs). The modules are loaded by the executable.
The ld and .reload commands of WinDbg do not load modules, they load symbol information (PDB files).
The process of changing the address of a module is called rebasing. It happens if the base address is not available any more, e.g. in use by a heap already. In that case, you cannot prevent rebasing at all.
One thing that might help is disabling ASLR (address space layout randomization). You can change that setting in a DLL or EXE. It's part of the COFF header:
On Windows 7, there were ways to disable ASLR completely, but it's not recommended to change that setting on a per-system basis just to help you debug a single process.
Another option would be to use rebase.exe of the Windows SDK and change the base address to a virtual address that you think is more likely to be free at the time the DLL is loaded. I never did that myself, but the rebase help says:
If you want to rebase to a fixed address (ala QFE)
use the @@files.txt format where files.txt contains
address/size combos in addition to the filename
so, it sounds possible to define your own address.
answered Mar 27 at 21:33
Thomas WellerThomas Weller
31.1k11 gold badges78 silver badges149 bronze badges
WinDbg does not load modules (DLLs). The modules are loaded by the executable.
The ld and .reload commands of WinDbg do not load modules, they load symbol information (PDB files).
The process of changing the address of a module is called rebasing. It happens if the base address is not available any more, e.g. in use by a heap already. In that case, you cannot prevent rebasing at all.
One thing that might help is disabling ASLR (address space layout randomization). You can change that setting in a DLL or EXE. It's part of the COFF header:
On Windows 7, there were ways to disable ASLR completely, but it's not recommended to change that setting on a per-system basis just to help you debug a single process.
Another option would be to use rebase.exe of the Windows SDK and change the base address to a virtual address that you think is more likely to be free at the time the DLL is loaded. I never did that myself, but the rebase help says:
If you want to rebase to a fixed address (ala QFE)
use the @@files.txt format where files.txt contains
address/size combos in addition to the filename
so, it sounds possible to define your own address.
answered Mar 27 at 21:33
Thomas WellerThomas Weller
31.1k11 gold badges78 silver badges149 bronze badges
edited Mar 27 at 22:08
answered Mar 27 at 21:33
Thomas WellerThomas Weller
31.1k11 gold badges78 silver badges149 bronze badges
answered Mar 27 at 21:33
Thomas WellerThomas Weller
31.1k11 gold badges78 silver badges149 bronze badges
answered Mar 27 at 21:33
Thomas WellerThomas Weller
31.1k11 gold badges78 silver badges149 bronze badges
31.1k11 gold badges78 silver badges149 bronze badges
Checking the options, yes, I've also realized the main purpose of.reloadhad to do with symbols, but the official help page for it specifically says:In some cases, this command also reloads or unloads the module itself. The existence address parameter wouldn't have made much sense otherwise I think.
– OzgurH
Mar 27 at 21:51
As for ASLR, I did see the post in SO RE that was titled rather similar to mine, which in turn pointed me to the one you've linked. I was just trying that system-wide setting (through EMET), and it royally messed up the system. The debugger target was not working, and it was also causing problems with other applications in my case. I did also researched into rebasing options. The pages said that MS'srebase(does not take base address as parameter, and) sets it based on file name/hash , so it wouldn't quite guarantee clash-free base address, do you know if that's still the case?
– OzgurH
Mar 27 at 22:03
@OzgurH: it's possible that messing with ASLR in Windows >7 may cause problems. Indeed some people say there are problems in Win 8.1 already: digital-forensics.sans.org/blog/2014/02/17/… I've updated the answer regarding the fixed base address. Seems rather complicated.
– Thomas Weller
Mar 27 at 22:11
I was hoping for more of a virtual/on-the-fly/non-intrusive kind of resolution to be honest. However, if no other answer shows up in the next couple of days, I'll try out both rebase, and PE editing suggestions to see if they achieve what I'm after........ (Thanks for quick response/edit for my comment! - rebase may work after all (assuming ASLR doesn't always win!?)) (BTW, have you noticed my answer to your 5+ year old question (#20515857)? :) )
– OzgurH
Mar 27 at 22:18
add a comment |
Checking the options, yes, I've also realized the main purpose of.reloadhad to do with symbols, but the official help page for it specifically says:In some cases, this command also reloads or unloads the module itself. The existence address parameter wouldn't have made much sense otherwise I think.
– OzgurH
Mar 27 at 21:51
As for ASLR, I did see the post in SO RE that was titled rather similar to mine, which in turn pointed me to the one you've linked. I was just trying that system-wide setting (through EMET), and it royally messed up the system. The debugger target was not working, and it was also causing problems with other applications in my case. I did also researched into rebasing options. The pages said that MS'srebase(does not take base address as parameter, and) sets it based on file name/hash , so it wouldn't quite guarantee clash-free base address, do you know if that's still the case?
– OzgurH
Mar 27 at 22:03
@OzgurH: it's possible that messing with ASLR in Windows >7 may cause problems. Indeed some people say there are problems in Win 8.1 already: digital-forensics.sans.org/blog/2014/02/17/… I've updated the answer regarding the fixed base address. Seems rather complicated.
– Thomas Weller
Mar 27 at 22:11
I was hoping for more of a virtual/on-the-fly/non-intrusive kind of resolution to be honest. However, if no other answer shows up in the next couple of days, I'll try out both rebase, and PE editing suggestions to see if they achieve what I'm after........ (Thanks for quick response/edit for my comment! - rebase may work after all (assuming ASLR doesn't always win!?)) (BTW, have you noticed my answer to your 5+ year old question (#20515857)? :) )
– OzgurH
Mar 27 at 22:18
Checking the options, yes, I've also realized the main purpose of
.reload had to do with symbols, but the official help page for it specifically says: In some cases, this command also reloads or unloads the module itself. The existence address parameter wouldn't have made much sense otherwise I think.– OzgurH
Mar 27 at 21:51
Checking the options, yes, I've also realized the main purpose of
.reload had to do with symbols, but the official help page for it specifically says: In some cases, this command also reloads or unloads the module itself. The existence address parameter wouldn't have made much sense otherwise I think.– OzgurH
Mar 27 at 21:51
As for ASLR, I did see the post in SO RE that was titled rather similar to mine, which in turn pointed me to the one you've linked. I was just trying that system-wide setting (through EMET), and it royally messed up the system. The debugger target was not working, and it was also causing problems with other applications in my case. I did also researched into rebasing options. The pages said that MS's
rebase (does not take base address as parameter, and) sets it based on file name/hash , so it wouldn't quite guarantee clash-free base address, do you know if that's still the case?– OzgurH
Mar 27 at 22:03
As for ASLR, I did see the post in SO RE that was titled rather similar to mine, which in turn pointed me to the one you've linked. I was just trying that system-wide setting (through EMET), and it royally messed up the system. The debugger target was not working, and it was also causing problems with other applications in my case. I did also researched into rebasing options. The pages said that MS's
rebase (does not take base address as parameter, and) sets it based on file name/hash , so it wouldn't quite guarantee clash-free base address, do you know if that's still the case?– OzgurH
Mar 27 at 22:03
@OzgurH: it's possible that messing with ASLR in Windows >7 may cause problems. Indeed some people say there are problems in Win 8.1 already: digital-forensics.sans.org/blog/2014/02/17/… I've updated the answer regarding the fixed base address. Seems rather complicated.
– Thomas Weller
Mar 27 at 22:11
@OzgurH: it's possible that messing with ASLR in Windows >7 may cause problems. Indeed some people say there are problems in Win 8.1 already: digital-forensics.sans.org/blog/2014/02/17/… I've updated the answer regarding the fixed base address. Seems rather complicated.
– Thomas Weller
Mar 27 at 22:11
I was hoping for more of a virtual/on-the-fly/non-intrusive kind of resolution to be honest. However, if no other answer shows up in the next couple of days, I'll try out both rebase, and PE editing suggestions to see if they achieve what I'm after........ (Thanks for quick response/edit for my comment! - rebase may work after all (assuming ASLR doesn't always win!?)) (BTW, have you noticed my answer to your 5+ year old question (#20515857)? :) )
– OzgurH
Mar 27 at 22:18
I was hoping for more of a virtual/on-the-fly/non-intrusive kind of resolution to be honest. However, if no other answer shows up in the next couple of days, I'll try out both rebase, and PE editing suggestions to see if they achieve what I'm after........ (Thanks for quick response/edit for my comment! - rebase may work after all (assuming ASLR doesn't always win!?)) (BTW, have you noticed my answer to your 5+ year old question (#20515857)? :) )
– OzgurH
Mar 27 at 22:18
add a comment |
Got a question that you can’t ask on public Stack Overflow? Learn more about sharing private information with Stack Overflow for Teams.
Got a question that you can’t ask on public Stack Overflow? Learn more about sharing private information with Stack Overflow for Teams.
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55383561%2fforce-a-module-dll-to-be-loaded-at-a-specific-address%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
