Editing Portable Executable (section)

=== Address Space Layout Randomization (ASLR) ===
PE files aren't [[position-independent code|position-independent]] by default; they are compiled to run at a specific, fixed memory address. Modern operating systems use Address Space Layout Randomization ([[Address space layout randomization|ASLR]]) to make it harder for attackers to exploit memory-related vulnerabilities. ASLR works by randomly changing the memory address of important parts of the program every time it's loaded. This includes the base address of the program itself, shared libraries (DLLs), and memory areas like the heap and stack. ASLR rearranges the address space positions of key data areas of a process, including the base of the [[executable]] and the positions of the [[Stack-based memory allocation|stack]], [[Dynamic memory allocation|heap]] and [[Library (computer science)|libraries]]. By randomizing these memory addresses each time the process an application is loaded, ASLR prevents attackers from being able to reliably predict memory locations.