I have a question about how a DLL which is marked as non-ASLR compatible can have a different base address every time I run the program that loads it.
Basically, this DLL, which is not ASLR compatible (confirmed via both WinDbg-narly and dumpbin
) shows a different starting address every time it's run. I've done some research, and the only thing I see that would cause this sort of behavior would be the loader putting the library at a different address at runtime to account for two libraries that have the same preferred base address. However, every time I run the service (with the same config, same startup sequence, etc), I show a different base address for the library in question, and this base address never repeats (in the 20+ times I've tested it). I had assumed that if the loader were moving the library for a non-ASLR purpose, that the final base address would at least be the same every once in a while, or would be somewhat deterministic.
Does anyone have an idea of what could cause this sort of behavior?
MoveImages
exist in registry keyHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
, and if so, what's its value? – Jason Geffner Dec 16 '13 at 21:43