问题
I am a student who studies reverse engineering. After I studied ASLR on Windows, I was going to check it. following capture:
the image base of notepad are same on first and second time. Whenever I restart notepad on ollydbg, imagebase is same. I checked ASLR attributes on file via PEView and registry value on Windows 10 too. they are normal. is there any reason not be changed imagebase of notepad ?
回答1:
Base address will change on PC's restart. It will not change on app's restart.
Writing Secure Code for Windows Vista by Michael Howard - Senior Security Program Manager at Microsoft
来源：https://stackoverflow.com/questions/40623369/windows-10-exe-files-imagebase-doesnt-change