I am quite new in binary exploitation. I am doing a lot of beginners exercise here. I am confused about ASLR. I tried some binary exploitation thing in Linux. It was recommended that I should stop ASLR in Linux before analyzing the binary. it is the command for that --> echo 0 > /proc/sys/kernel/randomize_va_space Am I right here? am I turning off my ASLR (randomizing stack addresses)?

But When I did the Windows 10 binary exploitation(vulnserver). I had to put my payload into stack address. And I noticed that the stack address (jmp esp) was constant, not changing. Is ASLR works differently in various OS? I don't know If I am asking a write question. please tell me if you know.

  • Did you check if the binary has /DYNAMICBASE property set? If it is not set then it means that REBASE was opted out while compiling the program itself i.e. ASLR is not being used. – P4cK3tHuNt3R Aug 17 at 6:55
  • how do I check it in windows? – lucky thandel Aug 17 at 10:13

By using this tool from Didier Stevens you've been able to check/set/unset DEP/ASLR characteristics of your file. Check the file like this:

setdllcharacteristics.exe yourfile.exe

If the output said DYNAMIC_BASE = 0 then you can use +d option to enable DYNAMICBASE of your file:

setdllcharacteristics.exe +d yourfile.exe

And you can use -d to unset again.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.