Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
The conditions: say one patched programm has hardcoded address of printf() from dynamically loaded msvcrt80.dll. It works just fine on XP, but Win7 randomizes address space (ASLR), so this trick become impossible and program crashes with call of my hardcoded printf() address.
What should I do to retrieve IAT RVA of this printf() in win7 to make this work?
If you can patch the program's image, you don't actually need to hardcode the address. you can simply add another import entry to the already existing import tables and have it patched in automatically by the loader.
See Iczelion's tutorial on import tables to guide you further.
Of course, if you're trying to do that from shellcode, you'll need to walk the loader data, locating the DLL image. The Ldr member in PEB should help you with that.
If you'd be so kind to provide more details on what exactly you are trying to do, I'll update the answer; there is no simple answer to the "how to defeat ASLR" question.
call RVA(IAT+function)for some reason execution goes on, interpretingRVA(IAT+function)+4as opcode and here is application crash.