XP User program space allocation (5): Loading the system DLL

Ntdll.dll is the first system DLL loaded, its module information:

Name	Base	Size	Entry point
E:\WINDOWS\system32\ntdll.dll	7c920000	00093000	7c932c28

Corresponding block of Memory:

and exe slightly different, or using DUMPBIN to export its file content for comparison.

1.1 File Headers

DLLs and EXE files are all PE-formatted, so the structure of their headers is the same, looking at the information dump from the Ntdll.dll:

14C machine (x86)
4 number of sections
4802BDC5 time date stamp Mon Apr 14 10:13:25 2008
0 file pointer to symbol table
0 number of symbols
E0 size of optional header
210E characteristics
Executable
Line numbers stripped
Symbols stripped
32 bit word machine
DLL

Windows has allocated a space for it: