I loaded a file into OllyDbg, and on my Windows 8, I see offsets of this format '7780XXXX':


On my XP machine it goes like this 0041XXXX:


Why is there a difference in the format?

Help me understand, and thank you in advance.

  • 4
    Under Windows XP, binaries tend to get loaded at their preferred load address if there aren't any conflicts (e.g. between DLLs bound for the same load address), which avoids the need for relocations to be applied. Vista introduced Address Space Layout Randomisation (ASLR), which causes load addresses to be randomised within certain limits. Also, /LARGEADDRESSAWARE programs can see an extended address space if a 32-bit Windows is started with the /3GB switch; for Wow64 it's about 4GB. Shared/system DLLs tend to go to 7xxxxxxx
    – DarthGizka
    Feb 17, 2015 at 23:28

1 Answer 1


Because ASLR is enabled in Windows 8, but not in Windows XP. The memory space layout is randomized when ASLR is enabled. If you want to disable it for a particular executable, you can do it with the tool setdllcharacteristics. Here is an example of how to use it:

setdllcharacteristics.exe -d "<your executable>.exe"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.