I need to run a debugger on an application and analyze its startup, however the main DLL gets loaded at different addresses every time, which makes my job much harder. How can I disable ASLR completely, or at least force one DLL to be loaded at a particular, always constant address?
I believe on XP if you strip the relocation table from the DLL (Or null out the relocation tables RVA and size in the data directory), then the Windows loader will try to load the DLL at its preferred base address (The ImageBase in the Optional Header) as it can no longer be relocated.
So long as the memory at the preferred base address is available this should work. Later versions of Windows may prevent this depending on loader options AFAIK.
A handy tool to edit PE files is the freely available CFF Explorer.
To actually force a DLL to load at a particular address without making structural changes to it first, you need to allocate all of the rest of available memory first, and of course, ensure that the target location isn't in use already. To disable ASLR for any given file, you have to set the IMAGE_FILE_RELOCS_STRIPPED flag in the Characteristics field of the COFF header. Removing the relocation table won't do it, if the file opted into ASLR. Windows will still move it around, it just won't relocate any of the data. As far as I know, you can't turn off ASLR globally.
What the other posters are talking about are general methods for making a DLL always load at a particular address.
For what you want to do -- which is ensure that the absolute addresses are always relevant, vs module + offset -- is straightforward to do.
If you can load the binary on a Windows XP system, it is completely unaware of ASLR.
Alternately, you can completely disable ASLR, which will ensure that modules will always be loaded at their preferred address. This setting is controlled via
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages.
However, if the preferred address is unavailable, Windows will load it somewhere else. If you run into this issue, I recommend modifying the preferred base address manually. A good hex editor will allow you to do this.