Embodiments are directed to a computer-implemented method for determining whether a program has been modified. The method can include determining that a first instance of the program is loaded in main memory. The method can further include determining a starting memory location of the first instance of the program. A second instance of the program is loaded into main memory. The second instance of the program is loaded such that memory references in the second instance of the program are resolved as if the second instance were loaded at the starting memory location of the first instance of the program. The first instance of the program is compared with the second instance of the program.