i saw some program image base is 40 00 00, notepad is 1 00 00 00 and their start address also different, some is 40 20 00, notepad 1 00 6A E0, anyone know why they are different, coz i always thought, image base address and start address is generally 400000.

wish to know why there is a difference. thank you.

Start address can be more or less anything, it will depend on the compiler (or assembler) and the standard library used.

As for why you'd use a non-0x400000 imagebase for EXE files, no idea. For DLLs it makes good sense, though.

http://www.honeynet.org/scans/scan33/nico/index.html

that was pointed by shism2 to me, interesting

In "Microsoft Portable Executable and Common Object File Format Specification, Rev. 6.0" it is stated that ImageBase is a
It seems that EXEs in WINDOWS dir and its subdirs use different ImageBase just... to be different from all the rest applications. Maybe MS programmers just do not want these standard win32 executables to share the same address space with other apps... to decrease loading time, for example, or whatever else, who knows...

thanks fodder, okasvi & zhak for the clarification

i recalled from some of the documents i read, it said that each (program/pe file) in win32 has their own 4gb of memory, so how the

i felt confuse

how windows OS actually manages the memory? i don't have big picture yet

okasvi: that article is an interesting read, but "this simple modification will confuse some Reverse Engineers" is a bit weak

vbVeryBeginner: each program doesn't have it's own 4gb of memory, but it has it's own address space (which on standard configurations is 2GB "shared" for kernel, and 2GB private for each process). It's done by the use of x86 protected mode paging, and giving each process it's own pagetables.

Read about protected mode memory management in "IA-32 Intel® Architecture Software Developer’s Manual, volume 3". There you'll find the complete description of how paging and segmentation work.

or specifically, read "inside Windows" kind of books.. btw start address will never be the same as image base. image base is the start of your exe "file" (or image) in memory while start address (or entrypoint) is where code execution start.

we need different image base for dll because we can load many dlls inside 1 process and if their image base are the same, they will be relocated to different address. this is fatal for dlls which doesn't have relocations info since absolute addresses inside the dll no longer correct. relocations for exe generally not needed because it is the first to be loaded inside the process address space (other than kernel32.dll).