Rebase

Rebase is a command-line tool that you can use to specify the base addresses for the DLLs that your application uses.

The base address of a DLL is the location in virtual memory where the loader attempts to place the DLL. It is generally specified at link time. If a DLL cannot load at its base address because the memory is already occupied, the loader places the DLL elsewhere in virtual memory, then updates all calls into the DLL to reflect the new base address. Making these changes can be time consuming, because the image must be copied to the pagefile and modified for the new address. If you have a large application that uses many DLLs, it is important for each DLL to have a different base address to minimize load time. You will receive the following warning from the loader if a DLL is relocated:

LDR: Automatic DLL Relocation in ProcessName.
LDR: DLL ImageName base ImageBase relocated due to collision with ExistingImage.

When you pass all the DLLs for your application to Rebase, it bases each DLL at a unique address. You should not pass your .EXE file to Rebase. It is the first thing to be loaded, so there is no chance that something else can already be loaded at its default load address.

The system DLLs are currently based in memory from 0x70000000 to 0x78000000 (0x68000000 to 0x78000000 on MIPS). Therefore, you should base your DLLs from 0x60000000 to 0x68000000. One possible scheme is to choose a base address based on the first letter of the DLL name:

It is best to base DLLs from the top of the address range down, instead of from the bottom up. Dynamic memory is allocated from the bottom up and if a DLL tries to load where dynamic memory has been allocated, it will be relocated, just as if a DLL was loaded at that address.

To use Rebase to base your DLLs, use the following syntax:

rebase [options] image-names

Rebase has the following command-line options:

-b initial_base

Specify initial base address. It is mandatory that you use either the -b or -i option.

-i coffbase_filename

Read base addresses from the file coffbase_filename. It is mandatory that you use either the -b or -i option.

-c coffbase_filename

Write the list of base addresses to the file coffbase_filename. The filename extension is not included. Use -C to include filename extensions.

-d

Perform a top-down rebase.

-l logFilePath

Write image bases to log file.

-z

Allow rebasing the system file.

-R image_root

Set a root directory for use by the -G, -O, -N options.

-G filename

Group specified images together in address space. May be used multiple times. Specify a root directory with the -R option.

-N filename

Leave specified images at their original addresses. May be used multiple times. Specify a root directory with the -R option.

-O filename

Overlay images in address space. May be used multiple times. Specify a root directory with the -R option.

-x symbol_dir

Extract debug information into separate .DBG file before rebasing. Use symbol_dir to place the .DBG files are placed in the directories symbol_dir\EXE or symbol_dir\DLL, depending on whether the source is an .EXE file or a .DLL file. To specify the current directory for the symbol directory, use a period (.).

-p

Used with the -x option. Remove private debug information when creating .DBG files.

-a

Used with the -x option. Extract all debug information into the .DBG files.

-f

Strip relocations after rebasing the image. Causes failure to load.

-s

Just sum image range.

-q

Minimal output.

-v

Verbose output.

-?

Display command-line syntax.

Alternatively, you can use the ReBaseImage function.

Note  If you shared a section in your DLL, the loader will fail to load the image if it needs to be relocated and the shared section contains any relocations. This is a good reason to use named shared memory instead of using shared sections.