+- delphi4arab منتديات دلفي للعرب (https://delphi4arab.net/forum)
+-- قسم : منتديات دلفي للعرب التعليمية (https://delphi4arab.net/forum/forumdisplay.php?fid=3)
+--- قسم : مصادر دلفي مفتوحة تعليمية (https://delphi4arab.net/forum/forumdisplay.php?fid=14)
+--- الموضوع : Check if ASLR is enabled (/showthread.php?tid=9075)
الصفحات:
1
2
Check if ASLR is enabled - Agmcz - 28-12-2017
السلام عليكم
إجراء للتحقق من Address space layout randomization مفعلة أم لا
PHP كود :
unit uCheckASLR;
// Original C++ Source: https://stackoverflow.com/questions/47105480/how-to-check-if-aslr-is-enabled-for-a-process
// Converted to Delphi by Agmcz 28-12-2017 2:25:32
interface
uses
Windows;
function CheckASLR(dwProcessId: ULONG; out bASLR: Boolean): ULONG;
implementation
const
PROCESS_QUERY_LIMITED_INFORMATION = $1000;
type
TSectionImageInformation = record
TransferAddress: Pointer;
ZeroBits: ULONG;
MaximumStackSize: ULONG;
CommittedStackSize: ULONG;
SubSystemType: ULONG;
MinorSubsystemVersion: Word;
MajorSubsystemVersion: Word;
GpValue: ULONG;
ImageCharacteristics: Word;
DllCharacteristics: Word;
Machine: Word;
ImageContainsCode: Boolean;
ImageFlags: Byte;
LoaderFlags: ULONG;
ImageFileSize: ULONG;
CheckSum: ULONG;
end;
PROCESSINFOCLASS = (
ProcessBasicInformation,
ProcessQuotaLimits,
ProcessIoCounters,
ProcessVmCounters,
ProcessTimes,
ProcessBasePriority,
ProcessRaisePriority,
ProcessDebugPort,
ProcessExceptionPort,
ProcessAccessToken,
ProcessLdtInformation,
ProcessLdtSize,
ProcessDefaultHardErrorMode,
ProcessIoPortHandlers,
ProcessPooledUsageAndLimits,
ProcessWorkingSetWatch,
ProcessUserModeIOPL,
ProcessEnableAlignmentFaultFixup,
ProcessPriorityClass,
ProcessWx86Information,
ProcessHandleCount,
ProcessAffinityMask,
ProcessPriorityBoost,
ProcessDeviceMap,
ProcessSessionInformation,
ProcessForegroundInformation,
ProcessWow64Information,
ProcessImageFileName,
ProcessLUIDDeviceMapsEnabled,
ProcessBreakOnTermination,
ProcessDebugObjectHandle,
ProcessDebugFlags,
ProcessHandleTracing,
ProcessIoPriority,
ProcessExecuteFlags,
ProcessResourceManagement,
ProcessCookie,
ProcessImageInformation,
MaxProcessInfoClass);
type
NTSTATUS = LongWord;
function NtQueryInformationProcess(ProcessHandle: THandle; ProcessInformationClass: PROCESSINFOCLASS; ProcessInformation: Pointer; ProcessInformationLength: ULONG; ReturnLength: PULONG ): LongInt; stdcall; external 'ntdll.dll';
function RtlNtStatusToDosError(Status: NTSTATUS): Integer; stdcall; external 'ntdll.dll';
function CheckASLR(dwProcessId: ULONG; out bASLR: Boolean): ULONG;
var
hProcess: THandle;
sii: TSectionImageInformation;
status: NTSTATUS;
begin
hProcess := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, dwProcessId);
if (hProcess <> 0) and (hProcess <> INVALID_HANDLE_VALUE) then
begin
status := NtQueryInformationProcess(hProcess, ProcessImageInformation, @sii, SizeOf(sii), 0);
CloseHandle(hProcess);
if 0 <= status then
begin
bASLR := Boolean(sii.ImageFlags);
Result := NOERROR;
Exit;
end;
Result := RtlNtStatusToDosError(status);
Exit;
end;
Result := GetLastError;
end;
end.
RE: Check if ASLR is enabled - مبرمج حر - 07-01-2018
مشكوور اخي
لكن ما فائدتها ! ممكن مثال عملي
RE: Check if ASLR is enabled - Agmcz - 07-01-2018
فحص هيدر PE وتحقق من ASLR
PHP كود :
{************************************
* Coded by Agmcz *
* Hints by naquadria *
* Date: 2018-01-07 *
************************************}
unit uCheckASLR;
interface
uses
Windows;
function CheckASLR(const FileName: string): Boolean;
implementation
const
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = $0040;
IMAGE_DIRECTORY_ENTRY_BASERELOC = 5;
function CheckASLR(const FileName: string): Boolean;
var
hFile: THandle;
hMapping: DWORD;
pMap: Pointer;
dwSize: DWORD;
IDH: PImageDosHeader;
INH: PImageNtHeaders;
ISH: PImageSectionHeader;
n: Word;
dwRelocAddr, dwRelocSize: DWORD;
begin
Result := False;
hFile := CreateFile(PChar(FileName), GENERIC_READ, FILE_SHARE_READ or FILE_SHARE_WRITE, nil, OPEN_EXISTING, 0, 0);
if hFile <> INVALID_HANDLE_VALUE then
begin
dwSize := GetFileSize(hFile, nil);
hMapping := CreateFileMapping(hFile, nil, PAGE_READONLY, 0, dwSize, nil);
if hMapping <> 0 then
begin
pMap := MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, 0);
if pMap <> nil then
begin
IDH := PImageDosHeader(pMap);
if IDH.e_magic = IMAGE_DOS_SIGNATURE then
begin
INH := PImageNtHeaders(DWORD(pMap) + LongWord(IDH._lfanew));
if INH.Signature = IMAGE_NT_SIGNATURE then
begin
if (INH.OptionalHeader.DllCharacteristics and IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) = IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE then
begin
ISH := PImageSectionHeader(DWORD(pMap) + LongWord(IDH._lfanew) + SizeOf(DWORD) + SizeOf(INH.FileHeader) + INH.FileHeader.SizeOfOptionalHeader);
dwRelocAddr := INH.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress;
dwRelocSize := INH.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size;
if (dwRelocAddr <> 0) and (dwRelocSize <> 0) then
begin
for n := 0 to INH.FileHeader.NumberOfSections - 1 do
begin
if ISH.VirtualAddress = dwRelocAddr then
begin
if (ISH.Misc.VirtualSize <> 0) and (ISH.PointerToRawData <> 0) and (ISH.SizeOfRawData <> 0) then
Result := True;
Break;
end;
Inc(ISH);
end;
end;
end;
end;
end;
UnmapViewOfFile(pMap);
end;
CloseHandle(hMapping);
end;
CloseHandle(hFile);
end;
end;
end.
(07-01-2018, 02:17 PM)مبرمج حر كتب : مشكوور اخي(مقتبس من حل تمرين chimera#01 من منتدى AT4RE)
لكن ما فائدتها ! ممكن مثال عملي
هي نوع من أنواع الحماية قامت شركة مايكروسوفت بإضافتها في أنظمة التشغيل خاصتها منذ صدور نظام التشغيل فيستا كمحاولة لمنع التنبؤ بعناوين الذاكرة التي يتم فيها تحميل البرامج التنفيذية, هذه الطريقة كان هدفها جعل لودر نظام التشغيل يحمل البرنامج التنفيدي في عنوان عشوائي في كل مرة يتم فيها تشغيله وعند إعادة التشغيل للجهاز.
يعني عند عدم تفعيل ASLR يكون عنوان ImageBase ثابت موقعه
على غرار تفعيل والذي سيكون متغير.
ألق نظرة هنا
How can I enable DEP/NX and ASLR on a Delphi 2006 or earlier executable?
يتم إستعمال التوجيه SetPEOptFlags
كود :
//{$SetPEOptFlags $100} //to set the ASLR flag
//{$SetPEOptFlags $40} //to set the DEP flag
{$SetPEOptFlags $140} //to set both DEP + ASLR in one lineRE: Check if ASLR is enabled - Agmcz - 08-04-2018
السلام عليكم
بعض التصحيحات على الكود لأنه توجد أخطاء
PHP كود :
unit uCheckASLR;
// Original C++ Source: https://stackoverflow.com/questions/47105480/how-to-check-if-aslr-is-enabled-for-a-process
// Ported to Delphi by Agmcz 28-12-2017 2:25:32
// Fix 04-08-2018 10:56:25
interface
uses
Windows;
function CheckASLR(dwProcessId: LongWord; out bASLR: Boolean): LongWord;
implementation
const
PROCESS_QUERY_LIMITED_INFORMATION = $1000;
type
TSectionImageInformation = record
TransferAddress: Pointer;
ZeroBits: LongWord;
MaximumStackSize: LongWord;
CommittedStackSize: LongWord;
SubSystemType: LongWord;
MinorSubsystemVersion: Word;
MajorSubsystemVersion: Word;
GpValue: LongWord;
ImageCharacteristics: Word;
DllCharacteristics: Word;
Machine: Word;
ImageContainsCode: Boolean;
ImageFlags: Byte;
LoaderFlags: LongWord;
ImageFileSize: LongWord;
CheckSum: LongWord;
end;
PROCESSINFOCLASS = (
ProcessBasicInformation,
ProcessQuotaLimits,
ProcessIoCounters,
ProcessVmCounters,
ProcessTimes,
ProcessBasePriority,
ProcessRaisePriority,
ProcessDebugPort,
ProcessExceptionPort,
ProcessAccessToken,
ProcessLdtInformation,
ProcessLdtSize,
ProcessDefaultHardErrorMode,
ProcessIoPortHandlers,
ProcessPooledUsageAndLimits,
ProcessWorkingSetWatch,
ProcessUserModeIOPL,
ProcessEnableAlignmentFaultFixup,
ProcessPriorityClass,
ProcessWx86Information,
ProcessHandleCount,
ProcessAffinityMask,
ProcessPriorityBoost,
ProcessDeviceMap,
ProcessSessionInformation,
ProcessForegroundInformation,
ProcessWow64Information,
ProcessImageFileName,
ProcessLUIDDeviceMapsEnabled,
ProcessBreakOnTermination,
ProcessDebugObjectHandle,
ProcessDebugFlags,
ProcessHandleTracing,
ProcessIoPriority,
ProcessExecuteFlags,
ProcessResourceManagement,
ProcessCookie,
ProcessImageInformation,
MaxProcessInfoClass);
type
NTSTATUS = LongWord;
function NtQueryInformationProcess(ProcessHandle: THandle; ProcessInformationClass: PROCESSINFOCLASS; ProcessInformation: Pointer; ProcessInformationLength: ULONG; ReturnLength: PULONG ): LongInt; stdcall; external 'ntdll.dll';
function RtlNtStatusToDosError(Status: NTSTATUS): Integer; stdcall; external 'ntdll.dll';
function ImageDynamicallyRelocated(sii: TSectionImageInformation): Boolean;
begin
Result := (sii.ImageFlags and (1 shl 2)) = 1;
end;
function CheckASLR(dwProcessId: LongWord; out bASLR: Boolean): LongWord;
var
hProcess: THandle;
sii: TSectionImageInformation;
status: NTSTATUS;
begin
hProcess := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, dwProcessId);
if (hProcess <> 0) and (hProcess <> INVALID_HANDLE_VALUE) then
begin
status := NtQueryInformationProcess(hProcess, ProcessImageInformation, @sii, SizeOf(sii), 0);
CloseHandle(hProcess);
if 0 <= status then
begin
bASLR := ImageDynamicallyRelocated(sii);
Result := NOERROR;
Exit;
end;
Result := RtlNtStatusToDosError(status);
Exit;
end;
Result := GetLastError;
end;
end.
RE: Check if ASLR is enabled - Agmcz - 01-05-2018
مشكل في دالة ImageDynamicallyRelocated تم إصلاحه
PHP كود :
unit uCheckASLR;
// Original C++ Source: https://stackoverflow.com/questions/47105480/how-to-check-if-aslr-is-enabled-for-a-process
// Ported to Delphi by Agmcz 28-12-2017 2:25:32
// Fix 08-04-2018 10:56:25
// Fix2 01-05-2018 2:28:15
interface
uses
Windows;
function CheckASLR(dwProcessId: LongWord; out bASLR: Boolean): LongWord;
implementation
const
PROCESS_QUERY_LIMITED_INFORMATION = $1000;
type
TSectionImageInformation = record
TransferAddress: Pointer;
ZeroBits: LongWord;
MaximumStackSize: LongWord;
CommittedStackSize: LongWord;
SubSystemType: LongWord;
MinorSubsystemVersion: Word;
MajorSubsystemVersion: Word;
GpValue: LongWord;
ImageCharacteristics: Word;
DllCharacteristics: Word;
Machine: Word;
ImageContainsCode: Boolean;
ImageFlags: Byte;
LoaderFlags: LongWord;
ImageFileSize: LongWord;
CheckSum: LongWord;
end;
PROCESSINFOCLASS = (
ProcessBasicInformation,
ProcessQuotaLimits,
ProcessIoCounters,
ProcessVmCounters,
ProcessTimes,
ProcessBasePriority,
ProcessRaisePriority,
ProcessDebugPort,
ProcessExceptionPort,
ProcessAccessToken,
ProcessLdtInformation,
ProcessLdtSize,
ProcessDefaultHardErrorMode,
ProcessIoPortHandlers,
ProcessPooledUsageAndLimits,
ProcessWorkingSetWatch,
ProcessUserModeIOPL,
ProcessEnableAlignmentFaultFixup,
ProcessPriorityClass,
ProcessWx86Information,
ProcessHandleCount,
ProcessAffinityMask,
ProcessPriorityBoost,
ProcessDeviceMap,
ProcessSessionInformation,
ProcessForegroundInformation,
ProcessWow64Information,
ProcessImageFileName,
ProcessLUIDDeviceMapsEnabled,
ProcessBreakOnTermination,
ProcessDebugObjectHandle,
ProcessDebugFlags,
ProcessHandleTracing,
ProcessIoPriority,
ProcessExecuteFlags,
ProcessTlsInformation,
ProcessCookie,
ProcessImageInformation,
ProcessCycleTime,
ProcessPagePriority,
ProcessInstrumentationCallback,
ProcessThreadStackAllocation,
ProcessWorkingSetWatchEx,
ProcessImageFileNameWin32,
ProcessImageFileMapping,
ProcessAffinityUpdateMode,
ProcessMemoryAllocationMode,
ProcessGroupInformation,
ProcessTokenVirtualizationEnabled,
ProcessConsoleHostProcess,
ProcessWindowInformation,
MaxProcessInfoClass);
type
NTSTATUS = LongWord;
function NtQueryInformationProcess(ProcessHandle: THandle; ProcessInformationClass: PROCESSINFOCLASS; ProcessInformation: Pointer; ProcessInformationLength: ULONG; ReturnLength: PULONG ): LongInt; stdcall; external 'ntdll.dll';
function RtlNtStatusToDosError(Status: NTSTATUS): Integer; stdcall; external 'ntdll.dll';
function ImageDynamicallyRelocated(sii: TSectionImageInformation): Boolean;
asm
MOVZX EAX, BYTE PTR SS:[sii.ImageFlags]
SHR AL, 2
AND EAX, 1
end;
function CheckASLR(dwProcessId: LongWord; out bASLR: Boolean): LongWord;
var
hProcess: THandle;
sii: TSectionImageInformation;
status: NTSTATUS;
begin
hProcess := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, dwProcessId);
if (hProcess <> 0) and (hProcess <> INVALID_HANDLE_VALUE) then
begin
status := NtQueryInformationProcess(hProcess, ProcessImageInformation, @sii, SizeOf(sii), 0);
CloseHandle(hProcess);
if 0 <= status then
begin
bASLR := ImageDynamicallyRelocated(sii);
Result := NOERROR;
Exit;
end;
Result := RtlNtStatusToDosError(status);
Exit;
end;
Result := GetLastError;
end;
end.
RE: Check if ASLR is enabled - Agmcz - 01-05-2018
Check ASLR from Remote PEB
PHP كود :
unit uCheckASLR;
{************************************
* Coded by Agmcz *
* Date: 01-05-2018 *
************************************}
interface
uses
Windows;
function CheckASLRPEB32(hProcess: THandle): Boolean;
implementation
type
PProcessBasicInformation = ^TProcessBasicInformation;
TProcessBasicInformation = record
ExitStatus: LongInt;
PebBaseAddress: Pointer;
AffinityMask: Cardinal;
BasePriority: LongInt;
UniqueProcessId: Cardinal;
InheritedFromUniqueProcessId: Cardinal;
end;
function NtQueryInformationProcess(ProcessHandle: THandle; ProcessInformationClass: DWORD {PROCESSINFOCLASS}; ProcessInformation: Pointer; ProcessInformationLength: ULONG; ReturnLength: PULONG): LongInt; stdcall; external 'ntdll.dll';
function NtReadVirtualMemory(ProcessHandle: THandle; BaseAddress: Pointer; Buffer: Pointer; BufferLength: ULONG; ReturnLength: PULONG): Longint; stdcall; external 'ntdll.dll';
function ImageDynamicallyRelocated(BitField: Byte): Boolean;
asm
SHR AL, 2
AND AL, 1
end;
function CheckASLRPEB32(hProcess: THandle): Boolean;
var
PBI: TProcessBasicInformation;
BitField: Byte;
begin
Result := False;
if (hProcess <> 0) and (hProcess <> INVALID_HANDLE_VALUE) then
begin
if NtQueryInformationProcess(hProcess, 0{ProcessBasicInformation = 0}, @PBI, SizeOf(TProcessBasicInformation), 0) = 0 then
begin
if NtReadVirtualMemory(hProcess, Pointer(DWORD(PBI.PebBaseAddress) + 3), @BitField{Peb.BitField}, SizeOf(Byte), 0) = 0 then
Result := ImageDynamicallyRelocated(BitField);
end;
end;
end;
end.
RE: Check if ASLR is enabled - Agmcz - 16-05-2018
دعم كل من النظامين 32 و 64 بت
PHP كود :
unit uCheckASLR;
{************************************
* Coded by Agmcz *
* Date: 08-05-2018 *
************************************}
interface
uses
Windows;
function CheckASLRPEB(hProcess: THandle): Boolean;
implementation
type
PProcessBasicInformation = ^TProcessBasicInformation;
TProcessBasicInformation = record
ExitStatus: LongInt;
PebBaseAddress: Pointer;
AffinityMask: Cardinal;
BasePriority: LongInt;
UniqueProcessId: Cardinal;
InheritedFromUniqueProcessId: Cardinal;
end;
type
PProcessBasicInformation64 = ^TProcessBasicInformation64;
TProcessBasicInformation64 = record
ExitStatus: Cardinal;
Pad1: Cardinal;
PebBaseAddress: UInt64;
AffinityMask: UInt64;
BasePriority: Cardinal;
Pad2: Cardinal;
UniqueProcessId: UInt64;
InheritedFromUniqueProcessId: UInt64;
end;
type
TNtQueryInformationProcess = function(ProcessHandle: THandle; ProcessInformationClass: DWORD {PROCESSINFOCLASS}; ProcessInformation: Pointer; ProcessInformationLength: ULONG; ReturnLength: Pointer): LongInt; stdcall;
TNtReadVirtualMemory = function(ProcessHandle: THandle; BaseAddress: Pointer; Buffer: Pointer; BufferLength: ULONG; ReturnLength: PULONG): Longint; stdcall;
TNtWow64ReadVirtualMemory64 = function(ProcessHandle: THandle; BaseAddress: UInt64; Buffer: Pointer; BufferLength: UInt64; ReturnLength: Pointer): LongInt; stdcall;
function Is64OS: LongBool;
asm
XOR EAX, EAX
MOV EAX, FS:[$C0]
end;
function ImageDynamicallyRelocated(BitField: Byte): Boolean;
asm
CMP AL, 4
JNE @Else
SHR AL, 2
JMP @EndIF
@Else:
SHR AL, 3
@EndIF:
AND AL, 1
end;
function CheckASLRPEB(hProcess: THandle): Boolean;
var
PBI: TProcessBasicInformation;
PBI64: TProcessBasicInformation64;
BitField: Byte;
hntdll: HMODULE;
NtQueryInformationProcess: TNtQueryInformationProcess;
NtReadVirtualMemory: TNtReadVirtualMemory;
NtWow64QueryInformationProcess64: TNtQueryInformationProcess;
NtWow64ReadVirtualMemory64: TNtWow64ReadVirtualMemory64;
begin
Result := False;
if (hProcess <> 0) and (hProcess <> INVALID_HANDLE_VALUE) then
begin
hntdll := LoadLibrary('ntdll.dll');
if hntdll <> 0 then
begin
if Is64OS then
begin
@NtWow64QueryInformationProcess64 := GetProcAddress(hntdll, 'NtWow64QueryInformationProcess64');
@NtWow64ReadVirtualMemory64 := GetProcAddress(hntdll, 'NtWow64ReadVirtualMemory64');
if NtWow64QueryInformationProcess64(hProcess, 0{ProcessBasicInformation = 0}, @PBI64, SizeOf(TProcessBasicInformation64), 0) = 0 then
begin
if NtWow64ReadVirtualMemory64(hProcess, PBI64.PebBaseAddress + 3, @BitField{Peb.BitField}, SizeOf(Byte), 0) = 0 then
Result := ImageDynamicallyRelocated(BitField);
end;
end
else
begin
@NtQueryInformationProcess := GetProcAddress(hntdll, 'NtQueryInformationProcess');
@NtReadVirtualMemory := GetProcAddress(hntdll, 'NtReadVirtualMemory');
if NtQueryInformationProcess(hProcess, 0{ProcessBasicInformation = 0}, @PBI, SizeOf(TProcessBasicInformation), 0) = 0 then
begin
if NtReadVirtualMemory(hProcess, Pointer(DWORD(PBI.PebBaseAddress) + 3), @BitField{Peb.BitField}, SizeOf(Byte), nil) = 0 then
Result := ImageDynamicallyRelocated(BitField);
end;
end;
FreeLibrary(hntdll);
end;
end;
end;
end.
RE: Check if ASLR is enabled - Agmcz - 30-05-2018
Original C++ Source:
Check ASLR from file 2
PHP كود :
unit uCheckASLR;
PHP كود :
interface
uses
Windows;
type
NTSTATUS = ULONG;
SIZE_T = Cardinal;
PVOID = Pointer;
PLARGE_INTEGER = ^LARGE_INTEGER;
HANDLE = THANDLE;
function CheckASLR(const FileName: WideString; out bASLR: Boolean): NTSTATUS;
implementation
const
FILE_READ_DATA = $0001; // file & pipe
FILE_READ_EA = $0008; // file & directory
FILE_READ_ATTRIBUTES = $0080; // all
FILE_GENERIC_READ = STANDARD_RIGHTS_READ or FILE_READ_DATA or
FILE_READ_ATTRIBUTES or FILE_READ_EA or SYNCHRONIZE;
FILE_SHARE_VALID_FLAGS = $00000007;
FILE_SYNCHRONOUS_IO_NONALERT = $00000020;
OBJ_CASE_INSENSITIVE = $00000040;
type
_SECTION_INFORMATION_CLASS = (
SectionBasicInformation,
SectionImageInformation);
SECTION_INFORMATION_CLASS = _SECTION_INFORMATION_CLASS;
TSectionInformationClass = SECTION_INFORMATION_CLASS;
TSectionImageInformation = record
TransferAddress: Pointer;
ZeroBits: LongWord;
MaximumStackSize: LongWord;
CommittedStackSize: LongWord;
SubSystemType: LongWord;
MinorSubsystemVersion: Word;
MajorSubsystemVersion: Word;
GpValue: LongWord;
ImageCharacteristics: Word;
DllCharacteristics: Word;
Machine: Word;
ImageContainsCode: Boolean;
ImageFlags: Byte;
LoaderFlags: LongWord;
ImageFileSize: LongWord;
CheckSum: LongWord;
end;
TIoStatusBlock = packed record
Status : NTSTATUS;
Information : ULONG;
end;
IO_STATUS_BLOCK = TIoStatusBlock;
P_IO_STATUS_BLOCK = ^TIoStatusBlock;
TUnicodeString = packed record
Length: WORD;
MaximumLength: WORD;
Buffer: PWideChar;
end;
PUnicodeString = ^TUnicodeString;
TUNICODE_STRING = TUnicodeString;
UNICODE_STRING = TUnicodeString;
PUNICODE_STRING = PUnicodeString;
POBJECT_ATTRIBUTES = ^OBJECT_ATTRIBUTES;
OBJECT_ATTRIBUTES = packed record
Length: ULONG;
RootDirectory: THandle;
ObjectName: PUNICODE_STRING;
Attributes: ULONG;
SecurityDescriptor: PVOID; // Points to type SECURITY_DESCRIPTOR
SecurityQualityOfService: PVOID; // Points to type SECURITY_QUALITY_OF_SERVICE
end;
function NtOpenFile(FileHandle: PHANDLE; DesiredAccess: ACCESS_MASK; ObjectAttributes: POBJECT_ATTRIBUTES; IoStatusBlock: P_IO_STATUS_BLOCK; ShareAccess: ULONG; OpenOptions: ULONG): LongInt; stdcall; external 'ntdll.dll';
function NtCreateSection(SectionHandle: PHANDLE; DesiredAccess: ACCESS_MASK; ObjectAttributes: POBJECT_ATTRIBUTES; SectionSize: PLARGE_INTEGER; Protect: ULONG; Attributes: ULONG; FileHandle: THandle): LongInt; stdcall; external 'ntdll.dll';
function NtClose(Handle : THandle): LongInt; stdcall; external 'ntdll.dll';
function ZwQuerySection(SectionHandle : THandle; SectionInformationClass : SECTION_INFORMATION_CLASS; SectionInformation: PVOID; SectionInformationLength: ULONG; ResultLength: PULONG): LongInt; stdcall; external 'ntdll.dll';
procedure RtlInitUnicodeString(DestinationString: PUNICODE_STRING; SourceString: PWideChar); stdcall; external 'ntdll.dll';
procedure InitializeObjectAttributes(p: POBJECT_ATTRIBUTES; n: PUNICODE_STRING;
a: ULONG; r: HANDLE; s: PVOID{PSECURITY_DESCRIPTOR});
begin
p^.Length := SizeOf(OBJECT_ATTRIBUTES);
p^.RootDirectory := r;
p^.Attributes := a;
p^.ObjectName := n;
p^.SecurityDescriptor := s;
p^.SecurityQualityOfService := nil;
end;
function ImageDynamicallyRelocated(sii: TSectionImageInformation): Boolean;
asm
MOVZX EAX, BYTE PTR SS:[sii.ImageFlags]
SHR AL, 2
AND EAX, 1
end;
function CheckASLR(const FileName: WideString; out bASLR: Boolean): NTSTATUS;
var
status: NTSTATUS;
hFile, hSection: THandle;
iosb: IO_STATUS_BLOCK;
oa: OBJECT_ATTRIBUTES;
us: TUnicodeString;
sii: TSectionImageInformation;
begin
RtlInitUnicodeString(@us, PWideChar('\??\' + FileName));
InitializeObjectAttributes(@oa, @us, OBJ_CASE_INSENSITIVE, 0, nil);
status := NtOpenFile(@hFile, FILE_GENERIC_READ, @oa, @iosb, FILE_SHARE_VALID_FLAGS, FILE_SYNCHRONOUS_IO_NONALERT);
if 0 <= status then
begin
status := NtCreateSection(@hSection, SECTION_QUERY, 0, 0, PAGE_READONLY, SEC_IMAGE, hFile);
NtClose(hFile);
if 0 <= status then
begin
status := ZwQuerySection(hSection, SectionImageInformation, @sii, sizeof(sii), 0);
NtClose(hSection);
if 0 <= status then
begin
bASLR := ImageDynamicallyRelocated(sii);
end;
end;
end;
Result := status;
end;
end.
RE: Check if ASLR is enabled - Agmcz - 11-06-2018
السلام عليكم
تم جمع كل الدوال في وحدة واحدة ونشرها على GitHup
PHP كود :
https://github.com/Agmcz/CheckASLR
RE: Check if ASLR is enabled - AX302 - 11-06-2018
السلام عليكم
عمل جميل ...فقط كملاحظة عدل كلمة written في الوصف