I have a question about how a DLL which is marked as non-ASLR compatible can have a different base address every time I run the program that loads it.
Basically, this DLL, which is not ASLR compatible (confirmed via both WinDbg-narly and
dumpbin) shows a different starting address every time it's run. I've done some research, and the only thing I see that would cause this sort of behavior would be the loader putting the library at a different address at runtime to account for two libraries that have the same preferred base address. However, every time I run the service (with the same config, same startup sequence, etc), I show a different base address for the library in question, and this base address never repeats (in the 20+ times I've tested it). I had assumed that if the loader were moving the library for a non-ASLR purpose, that the final base address would at least be the same every once in a while, or would be somewhat deterministic.
Does anyone have an idea of what could cause this sort of behavior?