Windows平台下能否构建位置无关代码的PE可执行文件？

Great question—this is a common point of confusion since Windows PE works a bit differently than ELF when it comes to position-independent code (PIC), especially for standalone executables rather than DLLs. The short answer is yes, you can build PE exes that load at different memory addresses on each execution, and even create fully position-independent code if needed. Here's how to approach it:

1. Use ASLR with Dynamic Base (Simplest Solution) #

If your only goal is to have the executable map to a random memory address on each run (without manually writing PIC code), this is the way to go:

• In Visual Studio, enable two key linker options:
  • /DYNAMICBASE: Tells the linker to generate an executable that supports Address Space Layout Randomization (ASLR), which makes the OS load the exe at a random base address each time.
  • /FIXED:NO: Explicitly disables fixed base address enforcement, ensuring the linker doesn't hardcode a specific load address into the PE header.
• When these options are enabled, the linker adds a relocation table to the PE file. The Windows loader uses this table to adjust all absolute memory references (like global variables, static data, or hardcoded function addresses) to match the actual load address at runtime.
• This works for most standard C/C++ code—you don't need to modify your source unless you're using extremely low-level absolute address tricks.

2. Manually Write Fully Position-Independent Code (For Full Control) #

If you want code that doesn't rely on the loader's relocation table (e.g., for self-modifying code, shellcode, or custom loaders), you can use relative addressing to avoid all absolute references:

• x64 is easier: It natively supports RIP-relative addressing, which lets you calculate addresses relative to the current instruction pointer. For example:

  #include <stdio.h>
  
  void my_pic_func() {
      printf("Running from a random address!\n");
  }
  
  int main() {
      // Calculate the address of my_pic_func using RIP relative addressing
      void (*func_ptr)();
      __asm {
          lea rax, [rip + my_pic_func - $]
          mov func_ptr, rax
      }
      func_ptr();
      return 0;
  }
  

• x86 requires a workaround: Since x86 doesn't have a direct RIP register, you can use a call instruction to get the current EIP, then compute offsets from there:

  #include <stdio.h>
  
  void my_pic_func() {
      printf("x86 PIC code works too!\n");
  }
  
  int main() {
      void (*func_ptr)();
      __asm {
          call get_eip
  get_eip:
          pop eax
          // Calculate offset between get_eip and my_pic_func
          sub eax, offset get_eip
          add eax, offset my_pic_func
          mov func_ptr, eax
      }
      func_ptr();
      return 0;
  }
  

• For global data, you'll need to use the same relative addressing trick to access variables instead of using their absolute addresses.

Key Limitations to Keep in Mind #

• Unlike ELF's PIC model (which uses GOT/PLT for lazy binding), Windows PE relies on load-time relocation when using /DYNAMICBASE. This means the loader modifies the code/data sections at load time to fix addresses, though it marks sections back to their original permissions (e.g., code becomes read-only again) afterward.
• If you link against libraries that don't support /DYNAMICBASE, you may run into base address conflicts. Always ensure all dependencies are built with ASLR enabled.
• Fully manual PIC code requires careful avoidance of any absolute address references—even implicit ones from compiler-generated code (like static initializers). You may need to disable certain compiler optimizations or use inline assembly to enforce relative addressing.

内容的提问来源于stack exchange，提问作者Bob5421