Is DLL always have the same Base Address?

Question

I\'m studying about windows and DLL stuffs and I have some question about it. :)

I made a simple program that loads my own DLL. This DLL has just simple functions, p

Answer 1

The operating system will load your DLL in whatever base address it pleases. You can specify a "preferred" base address, but if that does not happen to be available, (for whatever reason, which may well be completely out of your control,) your DLL will be relocated by the operating system to whatever address the operating system sees fit.

Answer 2

That's a common problem with DLLs that we encountered when trying to decode stacktraces issued by GNAT runtime (Ada).

When presented with a list of addresses (traceback) when our executables crash, we are able to perform addr2line on the given addresses and rebuild the call tree without issues.

On DLLs, this isn't the case (that's why I highly doubt that this issue is ASLR-related, else the executables would have the same random shift), vcsjones answer explains the "why".

Now to workaround this issue, you can write the address of a given symbol (example: the main program) to disk. When analysing a crash, just perform a difference between the address of the symbol in the mapfile and the address written to disk. Apply this difference to your addresses, and you'll be able to compute the theorical addresses, thus the call stack.

Answer 3

i load some DLL(for example, text.dll), is this DLL always have the same Base Address?

No. It is a preferred base address. If something is already loaded at that address, the loader will rebase it and fixup all of the addresses.

Other things, like Address Space Layout Randomization could cause it to be different every time the process starts.