为什么在ASLR机制下DLL文件在不同进程中加载的基址相同

// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "pch.h"

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        MessageBoxA(NULL, "您的进程已被注入", "注入警告", NULL);
        break;
    case DLL_THREAD_ATTACH:
        MessageBoxA(NULL, "您的进程已被注入", "注入警告", NULL);
        break;
    case DLL_THREAD_DETACH:
        MessageBoxA(NULL, "您的进程已被注入", "注入警告", NULL);
        break;
    case DLL_PROCESS_DETACH:
        MessageBoxA(NULL, "您的进程已被注入", "注入警告", NULL);
        break;
    }
    return TRUE;
}

#include <Windows.h>
#include <stdio.h>

int main()
{
    // 获取目标进程的句柄
    HWND hWnd = FindWindow(NULL, L"无标题 - Notepad");
    if (hWnd == NULL) {
        printf("未找到目标进程n");
        return 1;
    }

    DWORD processId;
    GetWindowThreadProcessId(hWnd, &processId);
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId);
    if (hProcess == NULL) {
        printf("无法打开目标进程n");
        return 1;
    }

    // 在目标进程中分配内存
    LPVOID pRemoteBuffer = VirtualAllocEx(hProcess, NULL, MAX_PATH, MEM_COMMIT, PAGE_READWRITE);
    if (pRemoteBuffer == NULL) {
        printf("无法在目标进程中分配内存n");
        return 1;
    }

    // 将DLL路径写入目标进程
    char dllPath[] = "E:\Test\InjectDll.dll";
    if (!WriteProcessMemory(hProcess, pRemoteBuffer, dllPath, sizeof(dllPath), NULL)) {
        printf("无法写入目标进程内存n");
        return 1;
    }

    // 获取LoadLibrary函数的地址
    HMODULE hKernel32 = GetModuleHandle(L"kernel32.dll");
    if (hKernel32 == NULL) {
        printf("未找到kernel32.dlln");
        return 1;
    }

    FARPROC pLoadLibrary = GetProcAddress(hKernel32, "LoadLibraryA");
    if (pLoadLibrary == NULL) {
        printf("未找到LoadLibrary函数n");
        return 1;
    }

    // 在目标进程中调用LoadLibrary函数加载DLL
    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pLoadLibrary, pRemoteBuffer, 0, NULL);
    if (hThread == NULL) {
        printf("无法在目标进程中创建远程线程n");
        return 1;
    }

    printf("DLL注入成功n");

    // 等待远程线程退出
    WaitForSingleObject(hThread, INFINITE);

    // 清理资源
    CloseHandle(hThread);
    VirtualFreeEx(hProcess, pRemoteBuffer, 0, MEM_RELEASE);
    CloseHandle(hProcess);

    return 0;
}