3

Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR.

GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0.

Consequently ProcessHacker (which uses this function) reports the process for this Delphi program to have ASLR disabled -- go into the process details window of ProcessHacker to see the ASLR status.

I can provide a minimal compiled Delphi program if that helps. I haven't been able to find out why ASLR is not activated.

Any ideas?

Edit: Relocation information is part of the executable. After even more debugging I found out that Delphi's delay loading code for functions imported from DLLs is the culprit. I'll precise the question when I have more information or a solution.

Edit2: I posted the executables as attachment in the following forum, since I found no way to attach anything here: http://wj32.org/processhacker/forums/viewtopic.php?p=6887#p6887

3
  • Relocation information is part of the executable. After even more debugging I found out that Delphi's delay loading code for functions imported from DLLs is the culprit. Now on to debugging this...
    – musings
    Jan 7, 2016 at 17:49
  • I would like to see the executable which produces this effect Jan 8, 2016 at 17:26
  • I added the executables in the last edit.
    – musings
    Jan 8, 2016 at 19:06

1 Answer 1

0

I'm having the same problem for a long time and had lots of investigation on this matter. In older Delphi compilers this problem don't exist and as your mentioned it is due to some API's being converted to delayed load import functions.

A while ago I reported this issue to Embarcadero and it seems they are working on it (https://blog.marcocantu.com/blog/rad111_pe_security.html). They provided a solution for now and willing to fix it in the near feature (I hope the next release).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.