[Delphi] Check if ASLR is enabled
1 Attachment(s)
Check if ASLR is enabled.
Code:
{************************************ |
Can post the attachment outside of this board? Thx
|
Hi,
Code:
https://nofile.io/f/YtbJBoKEcTt/ASLR+Checker.rar |
Why not simply check the bit "Relocations Stripped" at PE characteristics, as does the PE_ASLR.HEM HIEW32 plugin?
|
Because that's just plain wrong, the two flags don't exclude each other.
|
But when DLLCHARACTERISTICS.RelocationsStrippedBit=1 all others ignored. Agree?
..however you are right, if the file is processed by the plugin PE_ASLR.HEM with this bit set to 1, then additional checks will be required after clear it. |
Microsoft didn't implement two linker options for fun, these are two individual flags doing different things and can be enabled or disabled independently from each other.
So if you want to know if a file is ASLR enabled, then you check the flag telling you if a file is ASLR enabled and not the flag telling you if a file has relocations. (I'm aware the code posted here does check for a relocation table, but relocations are no requirement for ASLR) |
you must check bit "IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE" in PE.OPTIONAL_HEADER.DllCharacteristics member.
|
1 Attachment(s)
more...
check if ASLR is enabled from process Code:
unit uCheckASLR; |
theres a bug in the code above..
bASLR := Boolean(sii.ImageFlags); right there.. ImageFlags is a set of bitflags, to test for the aslr portion you need to and it and check the result, so you need to check bit 2, you're just blindly assuming that any non zero value for the whole thing means alsr is enabled.. this is wrong ----- UINT8 ImageFlags; // 0x0023 / 0x0033; 0x0001 / 0x0001 Bytes struct // 7 / 7 elements; 0x0001 / 0x0001 Bytes { UINT8 ComPlusNativeReady : 1; // 0x0023 / 0x0033; Bit: 0 UINT8 ComPlusILOnly : 1; // 0x0023 / 0x0033; Bit: 1 UINT8 ImageDynamicallyRelocated : 1; // 0x0023 / 0x0033; Bit: 2 UINT8 ImageMappedFlat : 1; // 0x0023 / 0x0033; Bit: 3 UINT8 BaseBelow4gb : 1; // 0x0023 / 0x0033; Bit: 4 UINT8 ComPlusPrefer32bit : 1; // 0x0023 / 0x0033; Bit: 5 UINT8 Reserved : 2; // 0x0023 / 0x0033; Bits: 6 - 7 }; |
1 Attachment(s)
Okay
now it works correctly. Code:
unit uCheckASLR; |
What is the version of Delphi that you guys are using?
|
1 Attachment(s)
Fix func ImageDynamicallyRelocated
Code:
unit uCheckASLR; |
Quote:
|
Check ASLR from Remote PEB
1 Attachment(s)
More..
Check ASLR from Remote PEB Code:
unit uCheckASLR; |
All times are GMT +8. The time now is 10:23. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX