Most malicious software uses fixed-offsets, so any kind of ASLR makes all this not work. And while it's possible to search the address space, in practice this is actually quite hard, even for 32-bit.