Does function offset inside a module remain the same always?
I have an executable (say notepad.exe). I am trying to create a function map for this executable. So when I run this executable it gets loaded in some address (base address of module). Now each function will have some offset inside the module. I try and uniquely identify each function by their offset (where the code of a function starts) inside the module. Do you think this offset will always remain the same, no matter on which machine I run the ex开发者_运维技巧ecutable?
Windows has had, since Vista, a feature known as address-space layout randomization, where the base of executables is placed at random start addresses. The goal is to thwart certain kinds of security attacks. Right now, no internal randomization of functions takes place, but there is nothing preventing that from happening in a new version of Windows.
精彩评论