7

I need to run a debugger on an application and analyze its startup, however the main DLL gets loaded at different addresses every time, which makes my job much harder. How can I disable ASLR completely, or at least force one DLL to be loaded at a particular, always constant address?

5

I believe on XP if you strip the relocation table from the DLL (Or null out the relocation tables RVA and size in the data directory), then the Windows loader will try to load the DLL at its preferred base address (The ImageBase in the Optional Header) as it can no longer be relocated.

So long as the memory at the preferred base address is available this should work. Later versions of Windows may prevent this depending on loader options AFAIK.

A handy tool to edit PE files is the freely available CFF Explorer.

| improve this answer | |
  • 1
    CFF Explorer is the best, agreed. – Ditmar Wendt Jul 26 '13 at 20:55
  • You say "if you strip the relocation table [...] then the Windows loader will try to load the DLL at its preferred base address". So where does it try to load it otherwise? Isn't it the point, that Windows loads a DLL at its preferred base address, unless its taken? I'm talking about non-ASLR case. – cubuspl42 Feb 26 '18 at 22:57
5

To actually force a DLL to load at a particular address without making structural changes to it first, you need to allocate all of the rest of available memory first, and of course, ensure that the target location isn't in use already. To disable ASLR for any given file, you have to set the IMAGE_FILE_RELOCS_STRIPPED flag in the Characteristics field of the COFF header. Removing the relocation table won't do it, if the file opted into ASLR. Windows will still move it around, it just won't relocate any of the data. As far as I know, you can't turn off ASLR globally.

| improve this answer | |
3

What the other posters are talking about are general methods for making a DLL always load at a particular address.

For what you want to do -- which is ensure that the absolute addresses are always relevant, vs module + offset -- is straightforward to do.

If you can load the binary on a Windows XP system, it is completely unaware of ASLR.

Alternately, you can completely disable ASLR, which will ensure that modules will always be loaded at their preferred address. This setting is controlled via HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages.

However, if the preferred address is unavailable, Windows will load it somewhere else. If you run into this issue, I recommend modifying the preferred base address manually. A good hex editor will allow you to do this.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.