Monero GUI not linked with /DYNAMICBASE or hardening on windows, no ASLR

How it was found

Summary: The monero daemon is compiled and linked without ASLR, at least on windows. This security hardening feature should be enabled in order to make exploiting of this service harder.

Description: See above.

Releases Affected:

• At least v0.11.1.0 (probably more) / Tested on Windows 8.1

Steps To Reproduce:

1. Start the monero-gui and monero daemon on windows
2. Start Process Explorer https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer
3. Check ASLR under "select columns"
4. See that ASLR is not activated for this process.

Supporting Material/References:

• I've attached a screenshot of the sysinternals tool on my machine.

Impact

Exploiting code reuse attacks is alot easier without this feature. This might impact future bug bounty payouts because people can't exploit reliable bugs to get code execution :)