Check if ASLR is enabled

[Agmcz]

دعم كل من النظامين 32 و 64 بت

PHP كود :

unit uCheckASLR;

{************************************
* Coded by Agmcz                    *
* Date: 08-05-2018                  *
************************************}

interface

uses
  Windows;

function CheckASLRPEB(hProcess: THandle): Boolean;

implementation

type
  PProcessBasicInformation = ^TProcessBasicInformation;
  TProcessBasicInformation = record
    ExitStatus: LongInt;
    PebBaseAddress: Pointer;
    AffinityMask: Cardinal;
    BasePriority: LongInt;
    UniqueProcessId: Cardinal;
    InheritedFromUniqueProcessId: Cardinal;
  end;

type
  PProcessBasicInformation64 = ^TProcessBasicInformation64;
  TProcessBasicInformation64 = record
    ExitStatus: Cardinal;
    Pad1: Cardinal;
    PebBaseAddress: UInt64;
    AffinityMask: UInt64;
    BasePriority: Cardinal;
    Pad2: Cardinal;
    UniqueProcessId: UInt64;
    InheritedFromUniqueProcessId: UInt64;
  end;

type
  TNtQueryInformationProcess = function(ProcessHandle: THandle; ProcessInformationClass: DWORD {PROCESSINFOCLASS}; ProcessInformation: Pointer; ProcessInformationLength: ULONG; ReturnLength: Pointer): LongInt; stdcall;
  TNtReadVirtualMemory = function(ProcessHandle: THandle; BaseAddress: Pointer; Buffer: Pointer; BufferLength: ULONG; ReturnLength: PULONG): Longint; stdcall;
  TNtWow64ReadVirtualMemory64 = function(ProcessHandle: THandle; BaseAddress: UInt64; Buffer: Pointer; BufferLength: UInt64; ReturnLength: Pointer): LongInt; stdcall;

function Is64OS: LongBool;
asm
  XOR EAX, EAX
  MOV EAX, FS:[$C0]
end;

function ImageDynamicallyRelocated(BitField: Byte): Boolean;
asm
  CMP AL, 4
  JNE @Else
  SHR AL, 2
  JMP @EndIF
  @Else:
  SHR AL, 3
  @EndIF:
  AND AL, 1
end;

function CheckASLRPEB(hProcess: THandle): Boolean;
var
  PBI: TProcessBasicInformation;
  PBI64: TProcessBasicInformation64;
  BitField: Byte;
  hntdll: HMODULE;
  NtQueryInformationProcess: TNtQueryInformationProcess;
  NtReadVirtualMemory: TNtReadVirtualMemory;
  NtWow64QueryInformationProcess64: TNtQueryInformationProcess;
  NtWow64ReadVirtualMemory64: TNtWow64ReadVirtualMemory64;
begin
  Result := False;
  if (hProcess <> 0) and (hProcess <> INVALID_HANDLE_VALUE) then
  begin
    hntdll := LoadLibrary('ntdll.dll');
    if hntdll <> 0 then
    begin
      if Is64OS then
      begin
        @NtWow64QueryInformationProcess64 := GetProcAddress(hntdll, 'NtWow64QueryInformationProcess64');
        @NtWow64ReadVirtualMemory64 := GetProcAddress(hntdll, 'NtWow64ReadVirtualMemory64');
        if NtWow64QueryInformationProcess64(hProcess, 0{ProcessBasicInformation = 0}, @PBI64, SizeOf(TProcessBasicInformation64), 0) = 0 then
        begin
          if NtWow64ReadVirtualMemory64(hProcess, PBI64.PebBaseAddress + 3, @BitField{Peb.BitField}, SizeOf(Byte), 0) = 0 then
            Result := ImageDynamicallyRelocated(BitField);
        end;
      end
      else
      begin
        @NtQueryInformationProcess := GetProcAddress(hntdll, 'NtQueryInformationProcess');
        @NtReadVirtualMemory := GetProcAddress(hntdll, 'NtReadVirtualMemory');
        if NtQueryInformationProcess(hProcess, 0{ProcessBasicInformation = 0}, @PBI, SizeOf(TProcessBasicInformation), 0) = 0 then
        begin
          if NtReadVirtualMemory(hProcess, Pointer(DWORD(PBI.PebBaseAddress) + 3), @BitField{Peb.BitField}, SizeOf(Byte), nil) = 0 then
            Result := ImageDynamicallyRelocated(BitField);
        end;
      end;
      FreeLibrary(hntdll);
    end;
  end;
end;

end.