What I have done so far:
I found it in the AfxCodeHook.pas unit by Aphex.
I have also skimmed a bunch of interesting sample codes using it:
- Inject Library (how to inject a DLL into another process).
- Inject Library Ex (how to inject a DLL into another process using the Ex method).
- Create Process Ex (how to inject a DLL into a created process using the Ex method).
- Inject Executable (InjectLibraryEx’s true power: the ability to inject EXE files).
- Simple Api Hooking (how to use afxcodehook to manipulate calls to windows apis).
I have also read:
- Embarcadero’s RAD Studio help entry on
Image base addressand Base addresspage in Wikipedia.
Question:
I seek for an informed opinion and a simple explanation of the {$IMAGEBASE $13140000} directive in Layman’s Terms from seasoned Delphi coders.
This specifies the preferred base address of the DLL. If the DLL can be loaded at this address, then the loader will do so. If it cannot, then it needs to be relocated and all the absolute jumps in the DLL need to be adjusted to the new address.
When the loader attempts to map a DLL into a process address space, it first reads the preferred base address. Then it works out the size of the DLL. Finally it checks to see if a contiguous block of memory stretching from the base address to the base address + size can be found. If so then the DLL is loaded at the preferred base address. If another DLL, or the exe resides at the preferred base address, then the DLL will need to be relocated. If the application has reserved heap memory that overlaps with the preferred DLL load address space, then the DLL will need to be relocated.
If a DLL needs to be relocated then its physical pages cannot be shared between processes. The Windows system DLLs have carefully chosen base addresses to ensure that there are no collisions and that they can be shared.
Nowadays, Address Space Layout Randomization (ASLR) complicates matters even further.
You can learn more from these articles: