Portable Executable mapping

[sicker]

Heya,

according to the "great" microsoft debugger my portable executable image
is mapped at 0x36010000 but the .text section for example seems also
to be mapped at its virtual address of 0x11000. can anybody tell me
the reason for that?


regards,

sicker

[refractor]

Not 100% sure about your question, so I'll answer what I think you're asking (if I'm not, rephrase the question ).

There are 32 "slots" for processes in the address space in the operating system. Slot 0 is allocated to the currently running process (i.e. the running process is mapped there, run for a bit, then mapped out and another is mapped in to run).

So, an executing application exists at both a slot (1 to 31) and at slot 0. That's why your application appears at two virtual memory locations.

[sicker]

cheers mate

[joshbu [MSFT]]

[Matt Keys]