Search code examples
windowsportable-executable

What is there before ImageBase address in Virtual Address?

I know from the Microsoft documentation that the image base is set to 0x140000000 for 64-bit images and it is the base address where the executable file is first loaded into the memory.

So my questions are as follows

  1. What comes before 0x140000000 address and starting of virtual address first page (0x0000000)
  2. What does it mean by executable first loaded? Is it the entry point of the program (which is of course not the main function) or something else
Solution

  • What comes before 0x140000000 address and starting of virtual address first page (0x0000000)

    Whatever happens to allocate there, like DLLs, file mappings, heap memory, or this memory can be free. The first page is always inaccessible.

    What does it mean by executable first loaded? Is it the entry point of the program (which is of course not the main function) or something else

    Loaded means mapped into memory. After it is mapped into memory, its imports are resolved, statically linked DLLs are mapped into memory, their entry points are executed, and only then it comes to the executable entry point. Executable entry point is not really the first function to execute from the executable if it has TLS callbacks.