You may not be knowing however, that all dll's have a PREFERRED BASE ADDRESS. When a dll is loaded, the loader tries to load it at it's preferred base address. The reason for this being that all the symbols in the dll (imported/exported functions etc.) are relocated with this address in mind. To explain a bit further, let's say we have a dll named a.dll. Let's say it has one exported function say, b(). Usually when we build a dll, the default base address of 0x100000000 is taken. Let's say that the exported function b() is at offset 0x100 in the dll. Now the export table of the dll will have an entry of function b(), with it's address (also called RVA in binary image format, terminology, you should look up the details of these in MSDN for EXE/DLL (PE) image formats). The entry in the export table will be for an address 0x10000100, because the image base address is assumed as that. now where ever this function is called, this address will be used.

So when the dll is loaded by the binary loader, it's first job is to find out the preferred base address and try to load the dll at that address. But usually since all dll's use the DEFAULT (0x100000000) base address as preferred, the loader fails to load it there, and hence it has to load the dll at some other address. Now the next task for loader is to patch the symbol table of dll for the base address. So it goes on patching the tables with NEW base address, and does something called as Symbol Relocation to make the symbols (say function addresses) point to new address now.

As you can imagine, if your application uses, let's say 10 dll's and each have large symbol tables, and the loader has to relocate each of the dll's, your application will take a lot of time to load. This is highly undesirable. So what can you do to make this fast? This is where DLL REBASING comes into picture. DLL rebasing is where you patch the dll so that it's preferred base address is NOT the default one, but something else which you provide. You can do this in two ways. First way is to use the Microsoft REBASE utility. This comes with Visual Studio, and is used to rebase the dll AFTER it has been built. That is you use this utility on an already available dll. The second option is to set the base address in Visual Studio (VC++) from Project Settings->Link->Output option. This the place where you can also put the entry point symbol, version information etc. for your application and dll.

Both the ways depend on which stage of the development you are. Also, you should not select any random address for your dll's base address, there are specific GUIDELINES on, which addresses are reserved for MS products and it's dll's and which addresses you can use. Also if you have more than one dll, you should obviously give different addresses to them. Infact, we should always try to give some unique address wherever possible.

Rebasing the dll, really improves the dll loading time quite a lot. MS highly recommends it and it's very un-professional to leave the dll base address as default. You should always make it a point to rebase your dll. You can read the rebasing guidelines in MSDN.

1. Read about PE image format, RVA's, different types of tables (import, export etc.), symbol relocations etc. You can refer to www.wotsit.org for all kinds of binary and other files formats. IIRC, there are code samples also there about reading image formats (specially PE format).

This gives you a great insight into the exe/dll internals, it's internal structure and the PE format in general. The different steps and operations that go into loading exe's and dll'd. You also get to know about different sections and segments in the EXE/DLL, such as data/code segments. These things are of immense importance when you are doing low level system programming, specially assembly level debugging. Do attempt this at least once, whenever you have some free time.

Bpath Counter