Modern exploits use different techniques to bypass ASLR. One of the technique used in some IE exploits is to leak memory using a BSTR overwrite.
How can an attacker leak memory, and how can he use it to effectively bypass ASLR?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
this is how a BSTR represented in memory:
so an attacker will try to get an aligned heapspray and then trigger a vulnerability that will modify the Length part of a BSTR, it can be:
then the length of the BSTR will be so big that you can read a big block of memory, that simply contain pointers to DLLS, from that you get the base address of those DLLS, AND BOOM!!! ASLR bypassed!