Modern exploits use different techniques to bypass ASLR. One of the technique used in some IE exploits is to leak memory using a BSTR overwrite.
How can an attacker leak memory, and how can he use it to effectively bypass ASLR?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
this is how a BSTR represented in memory:
so an attacker will try to get an aligned heapspray and then trigger a vulnerability that will modify the Length part of a BSTR, it can be:
then the length of the BSTR will be so big that you can read a big block of memory, that simply contain pointers to DLLS, from that you get the base address of those DLLS, AND BOOM!!! ASLR bypassed!
GetModuleHandle() to get the base address of the module and the offset.
The offset is just
current address - base address.