Static offsets Vs. Loaded Offsets

Question

I am developing an application integrity concept tool that performs integrity checks based on a comparison of Windows syscalls in a static PE file on disk to those loaded. Can I match the offset of each syscall from the base address in the static file to the offest of the loaded function from the loaded base address to check that they correspond? I understand through ASLR the base address will change, but I suppose my question is, do the offsets from the base addresses (on disk and loaded) to the function calls remain the same?

Answer 1

As this is a Windows Q, there:

ASLR relocates executable images by picking a random offset and applying it to all addresses within an image that would otherwise be relative to its base address. That is to say:

If two functions in an EXE are at addresses 0x401000 and 0x401100, they will remain 0x100 bytes apart even after the image is relocated. Clearly this is important due to the prevalence of relative call and jmp instructions in x86 code. Similarly, the function at 0x401000 will remain 0x1000 bytes from the base address of the image, wherever it may be.

Likewise, if two static or global variables are adjacent in the image, they will remain adjacent after ASLR is applied.

So, the answer to your Q (in this Windows context) is essentially yes, those (code text) offsets stay the same in that sense, relative to each other. OTOH

Conversely, stack and heap variables and memory-mapped files are not part of the image and can be randomized at will without regard to what base address was picked.

So offsets of some of those (other) things can differ from run to run.