Printable View
Hi,
When i use GetProcessHeap GetProcessHeaps on win xp sp3 the heap address is same at every time i run the process but on win10 64 the heap address is different at every new run.
Is that because of the ASLR? and if yes, i found hear By default, all VB6 apps has no ASLR / DEP protection.
If that true then why the heap address changes every time i run the exe on win10 64?
If you know please help.
Yes. All the VB6 apps, by default, has no ASLR protection but this affects only for module. Heaps and some other strucutres are randomized always.Quote:
Originally Posted by BD48
Krivous,Thank You very much for reply.
I didn't understand , do you mean DLL? or the module address in memory?Quote:
but this affects only for module.
do you know a way to disable the ASLR for my process without going to the registry and effect all the system?
I appreciate your help
There is the special flag in the PE header IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE which means ASLR for the module is enabled, i.e. the module is loaded by the random base address. You can have the many modules and some of them have ASLR and other not, i.e. some modules have the random base addresses and others have the priority to load by the fixed address.Quote:
I didn't understand , do you mean DLL? or the module address in memory?
Why do you want to disable ALSR? Just the most of situations when it's needed are the exploitation of a vulnerability. What's your goal exactly?Quote:
do you know a way to disable the ASLR for my process without going to the registry and effect all the system?
I'm working on updating this tool,in Sysinternals Process Explorer you can see if the ASLR is enabled or not, and i want to add this to the project if possible.
as i mentioned before i want to disable the ASLR for my process (Current Process) for testing only i do not want to effect all the system.
Attachment 169033
Thank You for the informationQuote:
There is the special flag in the PE header IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE which means ASLR for the module is enabled, i.e. the module is loaded by the random base address. You can have the many modules and some of them have ASLR and other not, i.e. some modules have the random base addresses and others have the priority to load by the fixed address.
I just saw here:
what if i used (/FIXED:YES), is that disable the ASLR?Quote:
Originally Posted by The trick
VB6 applications by default have no ASLR/DEP.
Thank You The Trick.Quote:
VB6 applications by default have no ASLR/DEP.