When PE files are loaded into the memory, they are 64 kB aligned

Look at the Win32 compilation of Luo yunbin and see a small problem when searching the kernel32.dll base address. The book says:

MasterProgramThe return address obtained from the stack is passed as a parameter, and then aligned with 64 K, that is, it performs and with 0ffff0000h, and then decreases by 10000 h when searching by page!

Why is it 64 K aligned? Why is it not aligned by the size of one page in the memory? Why do we need to decrease 10000h? Wondering... So Baidu + Google struggled to find the answer... Please refer to this section!

"For modules loaded into the program, the base address is aligned. You can use the debugger to check that each module in the program includes the DLL and the program itself, the last four digits of the base address in hexadecimal format are 0, that is, 0xxxx0000h, that is, the PE Header will appear near these addresses, so the search efficiency is accelerated by subtracting 10000"

I believe you have understood it! 10000h is 64 K! ^_^ Haha, it's a little dish, but if you don't understand me, I hope it will be helpful to you! O (partition _ partition) O

 

 

The same question in the snow found the answer: Turn: http://bbs.pediy.com/showthread.php? T = 99859