I might be of some assistance here.
First off, executable files on Win32 are named Portable Executables.
Try googling Portable Executable format, it'll yield plenty of information.
Second, the process EXE is always loaded to what is referred to as it's ImageBase (defaults to 0x400000 with most tools but it can be overridden).
This happens because it's practically the first module to be mapped into the process address space.
And second because EXE's do not carry the extra information needed to relocate it.
With DLL's the Imagebase is only a hint of preference.
If a DLL can be mapped to it's ImageBase it will be.
Otherwise it will have to be relocated to some other address.
That being said, if all you wan't to do is determine the start address and size of the EXE in memory, then there's a pretty convenient API.
CreateToolhelp32Snapshot, Module32First & Module32Next will provide you with that information.
The first module entry returned belongs to the process EXE.
As for modifying the memory, I'm sure you know of Read/WriteProcessMemory.
EDIT:
I should probably clarify what an virtual address is.
In PE terminology there's Physical, Virtual and Relative addresses.
Physical refers to the file address/offset.
Virtual refers to the memory address.
Relative refers to an offset in memory, based from the ImageBase.
So, a VirtualAddress within an image is: ImageBase+RelativeAddress.
The distinction between Physical and Relative is important because PE files are not simply copied into memory.
But rather they're mapped according to their section table (PE files are split into various memory sections, which must be aligned).
In other words, there isn't a one to one relationship between what you see in a file and what's in memory.
Bookmarks