Search code examples
windowsdllaslr

DLL are loaded at the same address, why is it designed like that?

In Windows the same DLL are loaded in the same address across processes, e.g advapi32.dll

WmiPrvSE.exe:

enter image description here

svchost.exe:

enter image description here

Since windows has ASLR enabled, why is it designed like that?

Solution

  • ASLR randomizes the load address offset when the machine boots, it is not random per-process. ASLR protects you from code injected by a webpage etc. not from processes already running on your machine.

    Loading at the same address in every process is advantageous for page sharing but not guaranteed by the OS. Low-level libraries are more likely to load at the same address and advapi32 is pretty low-level.