// Original C++ Source: https://stackoverflow.com/questions/47105480/how-to-check-if-aslr-is-enabled-for-a-process // Converted to Delphi by Agmcz 28-12-2017 2:25:32
interface
uses Windows;
function CheckASLR(dwProcessId: ULONG; out bASLR: Boolean): ULONG;
function CheckASLR(dwProcessId: ULONG; out bASLR: Boolean): ULONG; var hProcess: THandle; sii: TSectionImageInformation; status: NTSTATUS; begin hProcess := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, dwProcessId); if (hProcess <> 0) and (hProcess <> INVALID_HANDLE_VALUE) then begin status := NtQueryInformationProcess(hProcess, ProcessImageInformation, @sii, SizeOf(sii), 0); CloseHandle(hProcess); if 0 <= status then begin bASLR := Boolean(sii.ImageFlags); Result := NOERROR; Exit; end; Result := RtlNtStatusToDosError(status); Exit; end; Result := GetLastError; end;
function CheckASLR(const FileName: string): Boolean; var hFile: THandle; hMapping: DWORD; pMap: Pointer; dwSize: DWORD; IDH: PImageDosHeader; INH: PImageNtHeaders; ISH: PImageSectionHeader; n: Word; dwRelocAddr, dwRelocSize: DWORD; begin Result := False; hFile := CreateFile(PChar(FileName), GENERIC_READ, FILE_SHARE_READ or FILE_SHARE_WRITE, nil, OPEN_EXISTING, 0, 0); if hFile <> INVALID_HANDLE_VALUE then begin dwSize := GetFileSize(hFile, nil); hMapping := CreateFileMapping(hFile, nil, PAGE_READONLY, 0, dwSize, nil); if hMapping <> 0 then begin pMap := MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, 0); if pMap <> nil then begin IDH := PImageDosHeader(pMap); if IDH.e_magic = IMAGE_DOS_SIGNATURE then begin INH := PImageNtHeaders(DWORD(pMap) + LongWord(IDH._lfanew)); if INH.Signature = IMAGE_NT_SIGNATURE then begin if (INH.OptionalHeader.DllCharacteristics and IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE) = IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE then begin ISH := PImageSectionHeader(DWORD(pMap) + LongWord(IDH._lfanew) + SizeOf(DWORD) + SizeOf(INH.FileHeader) + INH.FileHeader.SizeOfOptionalHeader); dwRelocAddr := INH.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress; dwRelocSize := INH.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size; if (dwRelocAddr <> 0) and (dwRelocSize <> 0) then begin for n := 0 to INH.FileHeader.NumberOfSections - 1 do begin if ISH.VirtualAddress = dwRelocAddr then begin if (ISH.Misc.VirtualSize <> 0) and (ISH.PointerToRawData <> 0) and (ISH.SizeOfRawData <> 0) then Result := True; Break; end; Inc(ISH); end; end; end; end; end; UnmapViewOfFile(pMap); end; CloseHandle(hMapping); end; CloseHandle(hFile); end; end;
end.
(07-01-2018, 02:17 PM)مبرمج حر كتب : مشكوور اخي
لكن ما فائدتها ! ممكن مثال عملي
(مقتبس من حل تمرين chimera#01 من منتدى AT4RE)
هي نوع من أنواع الحماية قامت شركة مايكروسوفت بإضافتها في أنظمة التشغيل خاصتها منذ صدور نظام التشغيل فيستا كمحاولة لمنع التنبؤ بعناوين الذاكرة التي يتم فيها تحميل البرامج التنفيذية, هذه الطريقة كان هدفها جعل لودر نظام التشغيل يحمل البرنامج التنفيدي في عنوان عشوائي في كل مرة يتم فيها تشغيله وعند إعادة التشغيل للجهاز.
السلام عليكم
بعض التصحيحات على الكود لأنه توجد أخطاء
PHP كود :
unit uCheckASLR;
// Original C++ Source: https://stackoverflow.com/questions/47105480/how-to-check-if-aslr-is-enabled-for-a-process // Ported to Delphi by Agmcz 28-12-2017 2:25:32 // Fix 04-08-2018 10:56:25
interface
uses Windows;
function CheckASLR(dwProcessId: LongWord; out bASLR: Boolean): LongWord;
function ImageDynamicallyRelocated(sii: TSectionImageInformation): Boolean; begin Result := (sii.ImageFlags and (1 shl 2)) = 1; end;
function CheckASLR(dwProcessId: LongWord; out bASLR: Boolean): LongWord; var hProcess: THandle; sii: TSectionImageInformation; status: NTSTATUS; begin hProcess := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, dwProcessId); if (hProcess <> 0) and (hProcess <> INVALID_HANDLE_VALUE) then begin status := NtQueryInformationProcess(hProcess, ProcessImageInformation, @sii, SizeOf(sii), 0); CloseHandle(hProcess); if 0 <= status then begin bASLR := ImageDynamicallyRelocated(sii); Result := NOERROR; Exit; end; Result := RtlNtStatusToDosError(status); Exit; end; Result := GetLastError; end;
end.
سبحان الله وبحمده سبحان الله العظيم
كل من 2 users say قال شكرا ل Agmcz على المشاركة المفيدة2 users say Thank You to Agmcz for this post • محمد عبد العزيز, AX302
function ImageDynamicallyRelocated(sii: TSectionImageInformation): Boolean; asm MOVZX EAX, BYTE PTR SS:[sii.ImageFlags] SHR AL, 2 AND EAX, 1 end;
function CheckASLR(dwProcessId: LongWord; out bASLR: Boolean): LongWord; var hProcess: THandle; sii: TSectionImageInformation; status: NTSTATUS; begin hProcess := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, dwProcessId); if (hProcess <> 0) and (hProcess <> INVALID_HANDLE_VALUE) then begin status := NtQueryInformationProcess(hProcess, ProcessImageInformation, @sii, SizeOf(sii), 0); CloseHandle(hProcess); if 0 <= status then begin bASLR := ImageDynamicallyRelocated(sii); Result := NOERROR; Exit; end; Result := RtlNtStatusToDosError(status); Exit; end; Result := GetLastError; end;
end.
سبحان الله وبحمده سبحان الله العظيم
كل من 2 users say قال شكرا ل Agmcz على المشاركة المفيدة2 users say Thank You to Agmcz for this post • rahiche, invocker
function ImageDynamicallyRelocated(BitField: Byte): Boolean; asm SHR AL, 2 AND AL, 1 end;
function CheckASLRPEB32(hProcess: THandle): Boolean; var PBI: TProcessBasicInformation; BitField: Byte; begin Result := False; if (hProcess <> 0) and (hProcess <> INVALID_HANDLE_VALUE) then begin if NtQueryInformationProcess(hProcess, 0{ProcessBasicInformation = 0}, @PBI, SizeOf(TProcessBasicInformation), 0) = 0 then begin if NtReadVirtualMemory(hProcess, Pointer(DWORD(PBI.PebBaseAddress) + 3), @BitField{Peb.BitField}, SizeOf(Byte), 0) = 0 then Result := ImageDynamicallyRelocated(BitField); end; end; end;
end.
سبحان الله وبحمده سبحان الله العظيم
كل من 1 user says قال شكرا ل Agmcz على المشاركة المفيدة1 user says Thank You to Agmcz for this post • wadoud
function ImageDynamicallyRelocated(BitField: Byte): Boolean; asm CMP AL, 4 JNE @Else SHR AL, 2 JMP @EndIF @Else: SHR AL, 3 @EndIF: AND AL, 1 end;
function CheckASLRPEB(hProcess: THandle): Boolean; var PBI: TProcessBasicInformation; PBI64: TProcessBasicInformation64; BitField: Byte; hntdll: HMODULE; NtQueryInformationProcess: TNtQueryInformationProcess; NtReadVirtualMemory: TNtReadVirtualMemory; NtWow64QueryInformationProcess64: TNtQueryInformationProcess; NtWow64ReadVirtualMemory64: TNtWow64ReadVirtualMemory64; begin Result := False; if (hProcess <> 0) and (hProcess <> INVALID_HANDLE_VALUE) then begin hntdll := LoadLibrary('ntdll.dll'); if hntdll <> 0 then begin if Is64OS then begin @NtWow64QueryInformationProcess64 := GetProcAddress(hntdll, 'NtWow64QueryInformationProcess64'); @NtWow64ReadVirtualMemory64 := GetProcAddress(hntdll, 'NtWow64ReadVirtualMemory64'); if NtWow64QueryInformationProcess64(hProcess, 0{ProcessBasicInformation = 0}, @PBI64, SizeOf(TProcessBasicInformation64), 0) = 0 then begin if NtWow64ReadVirtualMemory64(hProcess, PBI64.PebBaseAddress + 3, @BitField{Peb.BitField}, SizeOf(Byte), 0) = 0 then Result := ImageDynamicallyRelocated(BitField); end; end else begin @NtQueryInformationProcess := GetProcAddress(hntdll, 'NtQueryInformationProcess'); @NtReadVirtualMemory := GetProcAddress(hntdll, 'NtReadVirtualMemory'); if NtQueryInformationProcess(hProcess, 0{ProcessBasicInformation = 0}, @PBI, SizeOf(TProcessBasicInformation), 0) = 0 then begin if NtReadVirtualMemory(hProcess, Pointer(DWORD(PBI.PebBaseAddress) + 3), @BitField{Peb.BitField}, SizeOf(Byte), nil) = 0 then Result := ImageDynamicallyRelocated(BitField); end; end; FreeLibrary(hntdll); end; end; end;
function ImageDynamicallyRelocated(sii: TSectionImageInformation): Boolean; asm MOVZX EAX, BYTE PTR SS:[sii.ImageFlags] SHR AL, 2 AND EAX, 1 end;
function CheckASLR(const FileName: WideString; out bASLR: Boolean): NTSTATUS; var status: NTSTATUS; hFile, hSection: THandle; iosb: IO_STATUS_BLOCK; oa: OBJECT_ATTRIBUTES; us: TUnicodeString; sii: TSectionImageInformation; begin RtlInitUnicodeString(@us, PWideChar('\??\' + FileName)); InitializeObjectAttributes(@oa, @us, OBJ_CASE_INSENSITIVE, 0, nil); status := NtOpenFile(@hFile, FILE_GENERIC_READ, @oa, @iosb, FILE_SHARE_VALID_FLAGS, FILE_SYNCHRONOUS_IO_NONALERT); if 0 <= status then begin status := NtCreateSection(@hSection, SECTION_QUERY, 0, 0, PAGE_READONLY, SEC_IMAGE, hFile); NtClose(hFile); if 0 <= status then begin status := ZwQuerySection(hSection, SectionImageInformation, @sii, sizeof(sii), 0); NtClose(hSection); if 0 <= status then begin bASLR := ImageDynamicallyRelocated(sii); end; end; end; Result := status; end;
![[-]](https://delphi4arab.net/forum/D4A2020/collapse.png)
