What's the replacement for REBASE.EXE?

问题:

I have a need to rebase the group of DLL files that I install with my program, because it's a 32-bit program and the address space is just too fragmented right now. Also there is the problem of the entirety of the DLLs being demand-paged into RAM on a cold boot so that the loader can rebase them, due to base address conflicts with some DLLs. Some DLLs are ones we have compiled; others are from 3rd parties.

What I would like to do is have a tool rebase a given set of DLLs so that the group of DLLs occupies a contiguous block of memory. This tool would then be run just prior to the compilation of the setup program, and the rebased DLLs would be installed in the application's private directory.

From what I understand, the REBASE.EXE tool included with Windows SDK does/did exactly that. Give it some DLLs, and it rebases them.

Unfortunately... Windows Software Development Kit (SDK) for Windows 8 Consumer Preview says:

Tools Many obsolete or deprecated tools have been removed from the Windows SDK. The following tools have been removed:

<snip> ReBase.exe

What now? I don't want to start using a tool that is apparently obsolete and is going to go away in the next version of Windows. Assuming I'm reading this right, what's the replacement for using ReBase.exe? I would like to restrict myself to using tools that come with Windows SDK and/or Visual Studio, rather than introducing 3rd-party tools and/or writing my own rebase code.

Or, am I approaching this entire problem the wrong way?

回答1:

editbin.exe comes with VS2010 and has a /REBASE option.

C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC>editbin
Microsoft (R) COFF/PE Editor Version 10.00.40219.01
Copyright (C) Microsoft Corporation.  All rights reserved.

usage: EDITBIN [options] [files]

   options:

      /ALLOWBIND[:NO]
      /ALLOWISOLATION[:NO]
      /BIND[:PATH=path]
      /DYNAMICBASE[:NO]
      /ERRORREPORT:{NONE|PROMPT|QUEUE|SEND}
      /HEAP:reserve[,commit]
      /LARGEADDRESSAWARE[:NO]
      /NOLOGO
      /NXCOMPAT[:NO]
      /REBASE[:[BASE=address][,BASEFILE][,DOWN]]
      /RELEASE
      /SECTION:name[=newname][,[[!]{CDEIKOMPRSUW}][A{1248PTSX}]]
      /STACK:reserve[,commit]
      /SUBSYSTEM:{BOOT_APPLICATION|CONSOLE|EFI_APPLICATION|
                  EFI_BOOT_SERVICE_DRIVER|EFI_ROM|EFI_RUNTIME_DRIVER|
                  NATIVE|POSIX|WINDOWS|WINDOWSCE}[,#[.##]]
      /SWAPRUN:{[!]CD|[!]NET}
      /TSAWARE[:NO]
      /VERSION:#[.#]

And as Mark points out you'll want to turn off ASLR, which you can do by using /DYNAMICBASE:no

回答2:

The reason Rebase.exe is deprecated is that it's not as useful as it used to be. Starting with Windows Vista, Microsoft implemented Address Space Layout Randomization which moves the system DLLs around every time you load them, and optionally the user DLLs as well.

If you're counting on rebasing to generate a large contiguous address space, you're going to be disappointed.

回答3:

Not to mention the use of "REBASE.EXE -b 0x58000000 -e 0x10000 -c coffbase.txt *.dll" against a set of files, simply to generate the COFFBASE file.
In other words not because you intend to actually rebase your files now, but because you want an accurate COFFBASE.TXT,
so that they will /already/ be built with a specific and non-conflicting base address every time they are built.