In Windows the same DLL are loaded in the same address across processes, e.g advapi32.dll

WmiPrvSE.exe:

svchost.exe:

Since windows has ASLR enabled, why is it designed like that?

CodePudding user response：

ASLR randomizes the load address offset when the machine boots, it is not random per-process. ASLR protects you from code injected by a webpage etc. not from processes already running on your machine.

Loading at the same address in every process is advantageous for page sharing but not guaranteed by the OS. Low-level libraries are more likely to load at the same address and advapi32 is pretty low-level.