| Previous | Next |
| ERROR_THREAD_WAS_SUSPENDED | ERROR_RXACT_STATE_CREATED |
ERROR_IMAGE_NOT_AT_BASE
What ERROR_IMAGE_NOT_AT_BASE means
An executable image could not be mapped at its preferred base address and required relocation. In practical terms, this status belongs to PE image loading and relocation: the loader places a DLL or executable image at a different virtual address because the preferred range is unavailable.
Typical causes
- Another mapping occupies the preferred address
- Address-space layout randomization intentionally relocates the image
- The image layout or rebasing assumptions are obsolete
How to investigate
- Record the module path, preferred image base, actual base, and architecture
- Verify that the image contains valid relocation data
- Check for code that incorrectly assumes fixed module addresses
Developer guidance
Relocation is normally handled by the Windows loader and is not a failure by itself. It becomes actionable when the image lacks relocations or software stores absolute addresses incorrectly.
Operational interpretation
When ERROR_IMAGE_NOT_AT_BASE appears, first determine whether the operation actually failed, completed with an informational condition, or transferred work to another component. Record the API name, returned value, affected process or object, and the immediately preceding event. For this code, the most useful boundary is the PE image loading and relocation boundary; broad machine-wide remediation before that boundary is identified can hide the original evidence.
Example scenario
An incident begins when another mapping occupies the preferred address. A responder investigating this result should not begin with a generic reboot that destroys the original context. A better first step is to record the module path, preferred image base, actual base, and architecture. That evidence connects it to its producing operation and reveals whether this particular result is repeatable, expected, or merely secondary.
Logging and telemetry
Telemetry for this Win32 error should preserve its numeric value, component version, process and thread identifiers, operation name, affected object or endpoint, elapsed time, and the first earlier failure in the same activity. Keep the result correlation identifier stable across callbacks so the status can be joined to the request that initiated this exact operation.
Recovery and validation
Apply recovery only after the responsible state has demonstrably changed. After changing that state, repeat one controlled this result scenario and verify both the returned status and the resulting system state. Absence of another log line is not sufficient: confirm that the intended PE image loading and relocation action completed, that no resource remains pending, and that later cleanup does not produce a different secondary error.
References
Looking for a different code? Search another status or error code.