0

Where does an injected DLL reside in memory?

My understanding of DLLs is that they get loaded once in physical memory so that multiple files can use their functions, thus saving resources by having reusable code loaded once instead of in every single process. The DLL's functions are located outside the process' address space and can be found via the memory mapping segment in between the heap and stack segments. For each process the memory map segment is located at a different virtual address, however the libraries/functions the memory mapped segment points to must be at the same address for each process otherwise they couldn't be shared between processes (assuming my understanding of this is all correct).

So when it's said that a DLL is loaded into a process' address space, is it loaded into the memory of that process, or somewhere else in the system and the process adds to the memory map to locate it? And on that note, what allows an injected library to migrate from one process to another?

gr0k
  • 789
  • 2
  • 9
  • 22
  • It's feasible for multiple processes to have their private virtual memory map to the same physical memory, isn't it? – Kerrek SB May 01 '14 at 08:54
  • Answer here: http://stackoverflow.com/questions/2846310/are-dll-files-loaded-once-for-every-program-or-once-for-all-programs – parrowdice May 01 '14 at 09:01
  • If you want to go behind the scenes: http://www.codeproject.com/Tips/430684/Loading-Win-DLLs-manually-without-LoadLibrary – parrowdice May 01 '14 at 09:03

0 Answers0