0

I'm programming a library that generates .NET assembly's manifests and I need to get the image base value of the assembly's modules. How can I get it in C#?

Termininja
  • 6,620
  • 12
  • 48
  • 49
TalBin
  • 43
  • 6
  • 4
    What is an "image base value"? If we have to Google to find out what that means, you can probably Google to get the answer yourself. – Robert Harvey May 08 '12 at 15:39
  • Do you mean the [preferred base address of a DLL](http://msdn.microsoft.com/en-us/library/b1awdekb.aspx)? – dtb May 08 '12 at 15:43
  • I think he means `ImageBase`, which ILDASM will provide [if you ask it to.](http://msdn.microsoft.com/en-us/library/ceats605.aspx) – Robert Harvey May 08 '12 at 15:44

1 Answers1

3

You have to read the Portable Executable Header of the DLL or EXE. Instructions for doing that can be found here:

Reading the Portable Executable (PE) header in C#
http://code.cheesydesign.com/?p=572

ImageBase is located in IMAGE_OPTIONAL_HEADER32:

[StructLayout(LayoutKind.Sequential, Pack = 1)]
public struct IMAGE_OPTIONAL_HEADER32 {
  public UInt16 Magic;
  public Byte MajorLinkerVersion;
  public Byte MinorLinkerVersion;
  public UInt32 SizeOfCode;
  public UInt32 SizeOfInitializedData;
  public UInt32 SizeOfUninitializedData;
  public UInt32 AddressOfEntryPoint;
  public UInt32 BaseOfCode;
  public UInt32 BaseOfData;
  public UInt32 ImageBase;         <------------------ Here
  public UInt32 SectionAlignment;
  public UInt32 FileAlignment;
  public UInt16 MajorOperatingSystemVersion;
  public UInt16 MinorOperatingSystemVersion;
  public UInt16 MajorImageVersion;
  public UInt16 MinorImageVersion;
  public UInt16 MajorSubsystemVersion;
  public UInt16 MinorSubsystemVersion;
  public UInt32 Win32VersionValue;
  public UInt32 SizeOfImage;
  public UInt32 SizeOfHeaders;
  public UInt32 CheckSum;
  public UInt16 Subsystem;
  public UInt16 DllCharacteristics;
  public UInt32 SizeOfStackReserve;
  public UInt32 SizeOfStackCommit;
  public UInt32 SizeOfHeapReserve;
  public UInt32 SizeOfHeapCommit;
  public UInt32 LoaderFlags;
  public UInt32 NumberOfRvaAndSizes;
}
Robert Harvey
  • 178,213
  • 47
  • 333
  • 501