Assuming I have booted a 32-bit Windows Server with the /3GB switch, how can I make a .NET application use the additional address space?
5 Answers
From what I can tell you have to use the editbin utility shown in the existing answer. There does not appear to be any way to set the flag using Visual Studio .NET, it looks like they encourage people to compile for 64 bit if possible instead of using the flag
http://connect.microsoft.com/VisualStudio/feedback/ViewFeedback.aspx?FeedbackID=93771
For doing it automaticaly from Visual studio, please refer to this question : flag from visual studio.
Add those lines to Post build:
call "$(DevEnvDir)..\tools\vsdevcmd.bat"
editbin /largeaddressaware "$(TargetPath)"
Thus far there haven't been an answer giving a cross-platform and open-source way to set LAA bit on a PE executable, so I decided to fill the gap.
Note: make sure you have a backup!
You can that with reverse-engineering framework radare2. In case you use a Linux distro, radare2 is typically in the repository. Unfortunately, the capability to set the bit isn't built-in, nonetheless it is quite easy with the following script:
e cfg.newshell=true # allows nested $(…) commands
s/ PE\0\0 # search PE file signature
s +4 # skip the signature
echo "Original content:"
pf.pe_image_file_header.characteristics
echo "Patching the file…"
s+ 0x12 # go to the characteristics field
wv2 $(?v $(pv2) \| 0x20) # 0x20 is the LAA bit, binary-OR it in the address
s-
echo "The new content:"
pf.pe_image_file_header.characteristics
Here's a demo how you use it (the script is in script.r2 file) with a notepad.exe file:
λ r2 -qi script.r2 -nnw notepad.exe
Searching 4 bytes in [0x1-0x620ca]
0x00000080 hit0_0 .mode.$PE\u0000\u0000Ld`J.
Original content:
characteristics : 0x00000096 = characteristics (bitfield) = 0x00000107 : IMAGE_FILE_RELOCS_STRIPPED | IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_LINE_NUMS_STRIPPED | IMAGE_FILE_32BIT_MACHINE
Patching the file…
The new content:
characteristics : 0x00000096 = characteristics (bitfield) = 0x00000127 : IMAGE_FILE_RELOCS_STRIPPED | IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_LINE_NUMS_STRIPPED | IMAGE_FILE_LARGE_ADDRESS_AWARE | IMAGE_FILE_32BIT_MACHINE
To double check it worked you can also use use objdump -p notepad.exe | grep "large address aware" command and see that it has output.
Related