windowsdllaslr

DLL are loaded at the same address, why is it designed like that?

In Windows the same DLL are loaded in the same address across processes, e.g advapi32.dll

WmiPrvSE.exe:

enter image description here

svchost.exe:

enter image description here

Since windows has ASLR enabled, why is it designed like that?

Solution

  • ASLR randomizes the load address offset when the machine boots, it is not random per-process. ASLR protects you from code injected by a webpage etc. not from processes already running on your machine.

    Loading at the same address in every process is advantageous for page sharing but not guaranteed by the OS. Low-level libraries are more likely to load at the same address and advapi32 is pretty low-level.