4

I'm studying Windows system internals and the question is just a guess.

I learn that DLL is a form of shared libraries, so at least the code section of the same DLL is shared between processes using it. (By adding the same page entries into the page table of these processes) The code section usually has something like jump tables, which need to be relocated (i.e. write the run-time virtual address to fix the pointer) before it's ready to be executed.

Assume that the same DLL aa.dll is mapped in two different processes at different virtual addresses. (e.g. a.exe 0x00400000 b.exe 0x00410000) The same pointer (at .text+0x100) will be fixed into different addresses. (e.g. a.exe 0x00400100 b.exe 0x004100100). So we have to make a copy of the code section and change it to adapt one process. Then how can the code section be shared?

Am I right?

6
  • The RAM pages can't be shared of course. Apr 25, 2017 at 14:31
  • I'm voting to close this question as off-topic because it is not (yet) a programming question. Can you explain the problem you are having with your program? Then we can try to solve it. Apr 25, 2017 at 14:55
  • 3
    @RaymondChen I disagree, questions about the internals of an operating system are, in fact, on topic. In fact, it would take a programmer to even be able to understand a question like this (far less be able to answer it). Apr 25, 2017 at 15:21
  • @EJoshuaS Thanks for the correction Apr 25, 2017 at 15:34
  • A shared DLL will usually be loaded at the same address in different processes, if it is possible to do so. However, to the best of my knowledge there is no guarantee. (In fact it is impossible to guarantee that, because the second process might already be using the address space in question.) Apr 26, 2017 at 4:24

1 Answer 1

1

Answering my own question. The first time a DLL is loaded, Windows would try to load it at the Preferred address which would not require relocation (i.e. fixing addresses due to the fact that code segment is located at x). If it cannot be loaded at the preferred address, it would be allocated virtual pages at a free address backed up by the DLL file itself (not swap file) but marked as Copy-On-Write. Now Windows has to go and fix up the assembly code using the relocation table. Hopefully only a small percentage of code needs to be fixed up and each code segment that is changed would be copied on write and put into physical memory somewhere. Each time a process cannot load a DLL at the preferred address, I believe this process would happen. This is why sometimes popular DLLs need to be rebased so that their preferred addresses don't conflict.

1
  • 1
    really ASLR change situation. with it DLLwith relocation's (almost) never loaded by address (IMAGE_OPTIONAL_HEADER.ImageBase) from file. when section on dll first created, system (in kernel) random relocate dll to some another address in selected range. and then try load dll by this address(in all processes). and now no any sense in rebase
    – RbMm
    Jul 1, 2020 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.