3

I loaded a file into OllyDbg, and on my Windows 8, I see offsets of this format '7780XXXX':

7780DE50
7780DE52
...

On my XP machine it goes like this 0041XXXX:

004171A2
004171A4
...

Why is there a difference in the format?

Help me understand, and thank you in advance.

  • 4
    Under Windows XP, binaries tend to get loaded at their preferred load address if there aren't any conflicts (e.g. between DLLs bound for the same load address), which avoids the need for relocations to be applied. Vista introduced Address Space Layout Randomisation (ASLR), which causes load addresses to be randomised within certain limits. Also, /LARGEADDRESSAWARE programs can see an extended address space if a 32-bit Windows is started with the /3GB switch; for Wow64 it's about 4GB. Shared/system DLLs tend to go to 7xxxxxxx – DarthGizka Feb 17 '15 at 23:28
2

Because ASLR is enabled in Windows 8, but not in Windows XP. The memory space layout is randomized when ASLR is enabled. If you want to disable it for a particular executable, you can do it with the tool setdllcharacteristics. Here is an example of how to use it:

setdllcharacteristics.exe -d "<your executable>.exe"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.