Results 1 to 2 of 2

Thread: No ASLR but dll loading at different locations Share/Save - My123World.Com!

  1. #1
    ... I am no Expert b0nd.g4h@gmail.com b0nd's Avatar
    Join Date
    Jul 2010
    Location
    irc.freenode.net #g4h
    Posts
    744

    No ASLR but dll loading at different locations

    There could be a scenario when a user sees some dll with no ASLR mitigation protection ON but loading at different location every time.
    Per my experience, it is because of presence of some other executable with higher privilege demanding for same image base location.

    E.g.
    One of my applications dll wanted to have an address location xyz. The main .exe (no ASLR) of same application also had the same preference and was more privileged than .dll.
    So even though dll didn't have aslr, the loader always had to relocate it to some other spot, which would be random


    Cheers!
    b0nd
    [*] To follow the path: look to the master, follow the master, walk with the master, see through the master,
    ------> become the master!!! <------
    [*] Everyone has a will to WIN but very few have the will to prepare to WIN
    [*] Invest yourself in everything you do, there's fun in being serious

  2. #2
    The DLL load order also determines the baseaddress of the loaded module. I mean if there are mor ethan one module with same ImageBAse address, then the module loaded first will be mapped to that address and the second module/dll will be relocated to some other address space.

    ..."vinnu"

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •