如何在不重新启动的情况下确定 Windows 是否应用 ASLR？
据我了解， ASLR 地址空间布局随机化< /sup> 只会在每次系统启动（每次重新引导）时进行随机重定位。
地址空间布局随机化 (ASLR)
当系统启动时，ASLR 将可执行映像移动到随机位置 靴子，使其更难被利用 代码可预测地运行。 （...）
如果是这种情况，我该如何“测试”，或者更确切地说，检查我的 C++ 模块或系统模块是否发生 ASLR（例如，kernel32 .dll），而不需要反复重新启动 Windows 并希望随机性发挥作用？
As far as I understand, ASLR Address Space Layout Randomization will only do random relocation per system start (per reboot).
Address Space Layout Randomization (ASLR)
ASLR moves executable images into random locations when a system
boots, making it harder for exploit
code to operate predictably. (...)
If this is the case, how can I then "test" or, rather, check that ASLR is happening for my C++ module or for a system module (say, kernel32.dll) without repeatedly restarting Windows and hoping the randomness kicks in?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这就是我要尝试的：
记住模块的
HMODULE句柄实际上是模块图像的基地址。您可以使用GetModuleHandle来获取这个值。如果将其与图像的可选标头值中的基地址进行比较，我们预计当 ASLR 打开时这两个值会不同。请记住，只有在某些系统 DLL 上使用 GetModuleHandle 时，这才是 ASLR 的明确指示；它适用于
kernel32，因为它不是映像重定位的典型候选者：由于
kernel32通常不会被重定位，因此如果 ASLR 被关闭，则可以合理地期望它被加载到其推荐的基地址处。如何从图像标题中获取推荐的基地址？最简单的方法是使用 Visual C++ 中包含的
DUMPBIN实用程序。如果您希望以编程方式执行此操作，则需要对可执行映像的标头进行一些探索，直到找到IMAGE_OPTIONAL_HEADER结构的ImageBase字段。有关 PE 标头的更多信息，我建议您“深入研究Win32 可移植可执行文件格式”，作者：Matt Pietrek。This is what I would try:
Remember that a module's
HMODULEhandle is actually the base address of the module's image. You can useGetModuleHandleto obtain this value. If you compare that to the base address in the image's optional header values, we would expect those two values to be different when ASLR is turned on.Keep in mind that this would only be a clear indicator of ASLR when
GetModuleHandleis used on certain system DLLs; it would work forkernel32because it is not a typical candidate for image relocation:Since
kernel32wouldn't typically be relocated, if ASLR was turned off it would be reasonable to expect it to be loaded at its recommended base address.How do you obtain the recommended base address from the image headers? The easiest way is to use the
DUMPBINutility included with Visual C++. If you'd rather do it programatically, you will need to do some spelunking through the executable image's headers until you locate theIMAGE_OPTIONAL_HEADERstructure'sImageBasefield. For more information about PE headers, I'd recommend "An In-Depth Look into the Win32 Portable Executable File Format" by Matt Pietrek.