NiftyLoadLibrary and Rebasing DLLs

Download source files - 3 Kb

Introduction

This code demonstrates one method to rebase DLL's on both Windows 9X and NT platforms to prevent base address collisions.

More Information

The method used in NiftyLoad is very simple, and probably prone to a number of flaws. The NiftyLoadLibrary() function first loades the library using the LoadLibrary() API.It then checks to see if the dll was successfully loaded at its normal base address. If the Dll's base address is the load address the function returns the HINSTANCE of the DLL and the calling application proceeds normally. If the base and load address are detected to be diffrent, then the dll is unloaded, and a memory mapped file is created. NiftyLoadLibrary() reads the dll into the memory mapped file and performs the fixups required if the dll was loaded at the memory mapped sections base address. The complete image is then written to the DLL, the memory section is closed and LoadLibrary() is again called to load the address. If everything went to plan, the dll should now load at the address previously occupied by the memory section without any relocation fixups being performed by the OS.

See the Platform SDK documentation on ReBaseImage() for more information.

The current version of NiftyLoadLibrary() suffers from a number of flaws:

1. The base address is chosen the wrong way. Rebased dll's should start from the top of the address space and work down. (ReBaseImage suggests base addresses between 0x68000000 to 0x78000000). I don't know how to search for available slots in the virtual memory though.
2. It only know how to deal with images that have the same file section alignement as the host PC's natrual page size. (usually 4K). Any dll that cannot be mapped directly into memory will probably get trashed.
3. NiftyLoad is unsuitalbe for situations where dll's are unloaded and reloaded frequently as it will rebase colliding dll'sinto the lowest available memory location which more than likley will be the preferred laod address for a recently released dll.
4. NiftyLoadLibrary() obviosuly cannot help with implicitl loaded DLL's, or DLL's loaded as inproc COM servers.

Please send any comments or bug reports to me via email. For any updates to this article, check my site here.