This is more like a knowledge question than actual implementation. I was wondering if any kernel function can have different virtual addresses after the system starts. My understanding of compilation for executable is virtual addresses are assigned for its binary but virtual to physical is done at run time by os.(paging. I know that stuff. So, no need 2 explain)
But in case of kernel functions, I see them having different virtual addresses when every time I restart the system.
1. How are kernel functions mapped in the address range? 2. Can they be mapped to different virtual addresses at run time. (I wonder how it is possible) 3. How is the address mapping for dlls? Are they given a virtual address at compilation or assigned a relative address at run time? (I think that’s how it is done.) 4. Is there any way to find if any kernel virtual address is pinned to physical memory.
Thanks
Traditionally, executables are assigned a fixed virtual address mapping at compile time. However, in recent years, it has become evident that this is bad for security – attackers can use their knowledge of exactly where things are in memory as part of an exploit. To help mitigate this, one can use position-independent or relocatable executables to allow the load address to be randomized (at least on Linux). However, this comes with a downside – starting the program takes more time, as the dynamic loader must perform relocations (either that, or there is additional overhead at runtime from position-independent machine code).
For the OS kernel, the additional overhead is trivial compared to the rest of the time spent booting; indeed, the Windows kernel actually dynamically links many of its components. So the kernel is an obvious place to randomize the load address.