When a DLL is loaded into a process, the DOS header, PE header, and section table are processed
When a DLL is loaded into a process, the DOS header, PE header, and section table are processed, then each section (e.g., .text
and .data
) is mapped into virtual memory at its RVA + ImageBase. Under ASLR, relocations from .reloc
are applied; after loading dependent DLLs, the Import Address Table (IAT) is updated and any TLS callbacks are executed. Code pages are shared across processes, while data pages are private to each process. Finally, DllMain
is called to complete initialization.
Comments
Post a Comment