It's extremely likely for stuff from Kernel32.dll. > That's not true. You're not considering different virtual addresses backed by the same pages. technically

It's extremely likely for stuff from Kernel32.dll. > That's not true. You're not considering different virtual addresses backed by the same pages. technically I suppose, but PEs don't tend to be relocatable, so if it mapped it in at different virtual addresses that would be extremely unlikely to be backed by the same pages as much of the just-mapped-in code would need relocs