Every DLL specifies a base address where it should be mapped during load time. However if that address is occupied by some other DLL then this DLL has to be relocated to new base address. This is called DLL Relocation or DLL Rebasing. This relocation process also happens for ASLR enabled modules.
In such cases, DLL Relocation Finder helps you to find these relocated DLLs and their new addresses. It also provides option to list only relocated or non-relocated or both type of DLLs.
Here are some of the practical observations w.r.t DLL Relocation
- On pre-Vista systems (winxp, win2k3) very few DLLs are relocated
- On post-Vista systems (vista, win7, win8) almost all the DLLs are relocated
- Also majority of the system DLLs are relocated to same new address across different processes (may vary in certain cases).
Being a command-line tool makes it easy to automate through scripting. Also it can be useful tool for researchers & developers.
It is fully portable and contain separate versions for 32-bit and 64-bit systems.It works on all the platforms starting from Windows XP to Windows 8.
|