Search code examples
imagedelphihookcode-injectionradix

{$IMAGEBASE $13140000} directive in a unit from an advanced hooking / injection library: explanation needed


What I have done so far:

I found it in the AfxCodeHook.pas unit by Aphex.

I have also skimmed a bunch of interesting sample codes using it:

I have also read:


Question:

I seek for an informed opinion and a simple explanation of the {$IMAGEBASE $13140000} directive in Layman's Terms from seasoned Delphi coders.


Solution

  • This specifies the preferred base address of the DLL. If the DLL can be loaded at this address, then the loader will do so. If it cannot, then it needs to be relocated and all the absolute jumps in the DLL need to be adjusted to the new address.

    When the loader attempts to map a DLL into a process address space, it first reads the preferred base address. Then it works out the size of the DLL. Finally it checks to see if a contiguous block of memory stretching from the base address to the base address + size can be found. If so then the DLL is loaded at the preferred base address. If another DLL, or the exe resides at the preferred base address, then the DLL will need to be relocated. If the application has reserved heap memory that overlaps with the preferred DLL load address space, then the DLL will need to be relocated.

    If a DLL needs to be relocated then its physical pages cannot be shared between processes. The Windows system DLLs have carefully chosen base addresses to ensure that there are no collisions and that they can be shared.

    Nowadays, Address Space Layout Randomization (ASLR) complicates matters even further.

    You can learn more from these articles: