When a DLL is loaded into a process, the DOS header, PE header, and section table are processed

 

When a DLL is loaded into a process, the DOS header, PE header, and section table are processed, then each section (e.g., .text and .data) is mapped into virtual memory at its RVA + ImageBase. Under ASLR, relocations from .reloc are applied; after loading dependent DLLs, the Import Address Table (IAT) is updated and any TLS callbacks are executed. Code pages are shared across processes, while data pages are private to each process. Finally, DllMain is called to complete initialization.

Comments

Popular posts from this blog

Japan Jazz Anthology Select: Jazz of the SP Era

In practice, the most workable approach is to measure a composite “civility score” built from multiple indicators.