C/C++ Disable Address Space Layout Randomization (ASLR) & DEP of Another Program

#include <Windows.h> #include <ImageHlp.h> #include <iostream> using namespace std; #pragma comment(lib, "ImageHlp.lib") bool Flag(LPCSTR path, bool ASLR, bool DEP) { LOADED_IMAGE PE; if (MapAndLoad(path, 0, &PE, 0, 0)) { if (ASLR) // Enable address space layout randomization PE.FileHeader->OptionalHeader.DllCharacteristics = IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE; else // Disable address space layout randomization PE.FileHeader->OptionalHeader.DllCharacteristics = NULL; if (DEP) // Enable data execution prevention PE.FileHeader->OptionalHeader.DllCharacteristics = IMAGE_DLLCHARACTERISTICS_NX_COMPAT; else // Disable data execution prevention PE.FileHeader->OptionalHeader.DllCharacteristics = NULL; UnMapAndLoad(&PE); return true; } return false; } int main() { Flag("test.exe", false, false); }

Changing the PE (which is what you are doing) doesnt do anything. If you dont believe me run NtQueryInformationProcess with ProcessExecuteFlags class.

If you really want to disable DEP/ASLR you need to change the values on _KPROCESS::Flags (offset 0x1BF on Win10).

Here's some (kernel) code that ACTUALLY disables DEP:

Code:

NTSTATUS SetProcessDEP(
    __in PSET_DEP_STATE Params
)
{
    if(!Params) return STATUS_INVALID_PARAMETER;

    NTSTATUS    status;
    PEPROCESS   process = NULL;

    status = PsLookupProcessByProcessId((HANDLE)Params->In.ProcessId, &process);

    if(NT_SUCCESS(status)) {
        PKEXECUTE_OPTIONS executeOptions = (PKEXECUTE_OPTIONS)((PUCHAR)process + 0x1bf);
        //
        // DisableData Execution Prevention
        //
        if(!Params->In.Enabled) {
            executeOptions->ExecuteOptions = 0;

            executeOptions->Flags.ExecuteDisable = 1;
            executeOptions->Flags.ImageDispatchEnable = 1;
            executeOptions->Flags.ExecuteDispatchEnable = 1;
        } 
        //
        // Enable Data Execution Prevention
        //
        else {
            executeOptions->ExecuteOptions = 0;

            executeOptions->Flags.ExecuteEnable = 1;
            executeOptions->Flags.Permanent = 1;
        }
    } else {
        PERROR("PsLookupProcessByProcessId", status);
    }
    if(process != NULL)
        ObDereferenceObject(process);
    return status;
}

From usermode, you can call NtSetInformationProcess with ProcessExecuteFlags to change those flags

Originally Posted by WasserEsser

This is so wrong. First of all you should learn about bitwise operations since IMAGE_OPTIONAL_HEADER->DllCharacteristics is a collection of bit flags.

Run down a test case. Pass the function a true for ASLR and a false for DEP. You'll set DllCharacteristics to IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE and right after set DllCharacteristics to 0. Where is your IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE now? You just reset everything to 0.

Woops, both were written for individual programs, and I just carelessly merged them. This can be fixed with a simple bitwise operation tho.
For the enabling part: |=
For the disabling part: &= ~

That should fix it

- - - Updated - - -

Originally Posted by MarkHC

Code:

NTSTATUS SetProcessDEP(
    __in PSET_DEP_STATE Params
)
{
    if(!Params) return STATUS_INVALID_PARAMETER;

    NTSTATUS    status;
    PEPROCESS   process = NULL;

    status = PsLookupProcessByProcessId((HANDLE)Params->In.ProcessId, &process);

    if(NT_SUCCESS(status)) {
        PKEXECUTE_OPTIONS executeOptions = (PKEXECUTE_OPTIONS)((PUCHAR)process + 0x1bf);
        //
        // DisableData Execution Prevention
        //
        if(!Params->In.Enabled) {
            executeOptions->ExecuteOptions = 0;

            executeOptions->Flags.ExecuteDisable = 1;
            executeOptions->Flags.ImageDispatchEnable = 1;
            executeOptions->Flags.ExecuteDispatchEnable = 1;
        } 
        //
        // Enable Data Execution Prevention
        //
        else {
            executeOptions->ExecuteOptions = 0;

            executeOptions->Flags.ExecuteEnable = 1;
            executeOptions->Flags.Permanent = 1;
        }
    } else {
        PERROR("PsLookupProcessByProcessId", status);
    }
    if(process != NULL)
        ObDereferenceObject(process);
    return status;
}

From usermode, you can call NtSetInformationProcess with ProcessExecuteFlags to change those flags

Not sure about DEP, but that totally cripples ASLR on the latest Win10:

C/C++ Disable Address Space Layout Randomization (ASLR) & DEP of Another Program

Post a Reply

Similar Threads

Tags for this Thread