CODEWITHSUNDEEP
windowsdllaslr
daisy
daisy

Reputation: 23511

DLL are loaded at the same address, why is it designed like that?

In Windows the same DLL are loaded in the same address across processes, e.g advapi32.dll

WmiPrvSE.exe:

enter image description here

svchost.exe:

enter image description here

Since windows has ASLR enabled, why is it designed like that?

Upvotes: 1

Views: 1019

Answers (1)

Anders
Anders

Reputation: 101666

ASLR randomizes the load address offset when the machine boots, it is not random per-process. ASLR protects you from code injected by a webpage etc. not from processes already running on your machine.

Loading at the same address in every process is advantageous for page sharing but not guaranteed by the OS. Low-level libraries are more likely to load at the same address and advapi32 is pretty low-level.

Upvotes: 3

Related Questions