Is kernel32.dll always loaded below 0x80000000 (x64) ?

301 views Asked by At

I have checked several x64 windows versions and the answer to the question in the title seems to be affirmative, even in processes with ASLR. The same seems to be true in case of ntdll.dll. However, I cannot find any confirmation of that in the MS documentation.

0

There are 0 answers