[Autogenerated] the address based load organization feature SLR
was first introduced in the windows vista.
The basic idea was to load images executable,
but more importantly DLS into pseudo random addresses.
So it's a set of random addresses,
one of which is being picked every time you restart the system and
the first one is picked for anti DLL and the rest of dealers are
being sorted in a descending order of addresses without anyone
overriding or overlapping other DLS.
And the reason this feature was introduced was in terms
of security when you have shell code,
which means code injected into a process without the benefit of the loader,
If it knows up front where certain functions are,
it could just call them without having to have any other kind of knowledge
that is needed and that was the case in the XP days.
But now, since these addresses are pseudo random,
the shell code cannot really guess where certain functions are,
such as get address and other useful functions that might let
this shell code do its malicious thing.
Unfortunately, this is not a silver bullet against shell code injections,
it's possible to bypass this problem by accessing the FS or GS
registers of the processor by the shell code.
This points to the threat environment block and from there there
is a known offset that points to the process,
environment block and from there you can actually get a
list of all the delay in the process,
do some passing of PS and find out any address for
functions that you're interested in.
This is not easy to do, but it is possible.
it has been done one of the benefits of SLR kind of a side benefit,
but still very important is the fact that you have very
little DLL collisions these days.
In the pre vista days creates a lot of days you might have a dealer
loaded into some address it wanted to load into and then another
dealer wanted to load into the same process in exactly the same
address or some other close by address,
which overlaps with the existing range of addresses used by the previous DLL,
that could not be allowed to the dealer was forced to be
relocated and even though that works for most DLS,
because they're not against relocation,
that would create some downsides as you have some more time spent
with relocating the DLL and you couldn't share the code for the
relocated pages in physical memory, which is a shame now because of a seller,
dealers are set in different addresses automatically without overlap.
So the relocations that were very frequent in the XP days are almost gone
and the penalty of these relocations is gone with it,
I will say that the Windows 10 and several 2016 and later versions
of Windows S lau is also supported in the kernel,
so certain data structures and other chunks of memories such as
the page pool and non page pool are loaded or,
or allocated from pseudo random addresses,
so that if you have some vulnerable driver that might be
vulnerable to attacks from user mode,
you can't from user mode guests which addresses are
being used for these data structures.