[Autogenerated] where can we see DLL relocations.
So here's process, Explorer, let me find Explorer,
which is in itself a process has so many DLS that
relocations are much more likely.
We're going to use the DLL tab here to see what's going on.
One of the things you can see here, there's various columns.
One of them is called the base and bases where the deal is
being loaded into the target process, this particular process,
but I also want to see where the L wanted to actually load by adding another
column called image base to add image based address here.
So where do we get relocations?
We get relocations when these addresses are different.
In this particular case we see image basis zero.
This just means that we have memory mapped files here,
so they're not really DLS, we don't really care about those.
But let's look for other DLS now in order to find them much more quickly
without having to comparer to address is here to explore,
supports another color, which only applies to deal?
S going to options.
Configure colors, all these colors are about processes except for one,
as you can see, it says relocated DLS, let me enable that.
So once I do that, if I scroll through these DLS,
some of them might become yellow.
Here's an example of a yellow DLL and this shows that the
D L wanted to load into this address.
18 and old zeros, but unfortunately that address was already taken.
So it was relocated to this particular.
Ad we can find perhaps some more of those learning around.
Here's another one wanted to load in exactly the same address.
You kind of get the idea why this address is
problematic and that's because by the way,
this is a default address used by visual studio,
so it had to be relocated to a different location.
We can even sort of course, by image based to see these things in action.
So you might find several of those yellows you can see
we have very close by addresses,
including identical address is obviously one of them of these DLS was loaded
into this address without any issues because it was the first,
but then others that wanted to load into the same address had to be relocated.
Thanks to s allow this is much more difficult to actually
get into and it's fairly rare these days,
in the XP days, you would have that all over the place.
So at least we have a slot for that,
even though from a security perspective it's not as powerful as
perhaps it used to be or Microsoft hoped it would be