2

The conditions: say one patched programm has hardcoded address of printf() from dynamically loaded msvcrt80.dll. It works just fine on XP, but Win7 randomizes address space (ASLR), so this trick become impossible and program crashes with call of my hardcoded printf() address.

What should I do to retrieve IAT RVA of this printf() in win7 to make this work?

  • Are you looking for ASLR bypassing by finding User32.dll and load GetProcAddr + LoadLibrary or do you want to walk your import table to find the already imported printf function? – Stolas Jun 26 '14 at 10:04
  • No, I dont need GetProcAdress. Both addresses considered known, but this dont help much. After call RVA(IAT+function) for some reason execution goes on, interpreting RVA(IAT+function)+4 as opcode and here is application crash. – see ya Jun 26 '14 at 10:19
5

If you can patch the program's image, you don't actually need to hardcode the address. you can simply add another import entry to the already existing import tables and have it patched in automatically by the loader.

See Iczelion's tutorial on import tables to guide you further.

Of course, if you're trying to do that from shellcode, you'll need to walk the loader data, locating the DLL image. The Ldr member in PEB should help you with that.

If you'd be so kind to provide more details on what exactly you are trying to do, I'll update the answer; there is no simple answer to the "how to defeat ASLR" question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.