[RESOLVED] ASLR & Heap Address

[BD48]

Hi,
When i use GetProcessHeap GetProcessHeaps on win xp sp3 the heap address is same at every time i run the process but on win10 64 the heap address is different at every new run.
Is that because of the ASLR? and if yes, i found hear By default, all VB6 apps has no ASLR / DEP protection.

If that true then why the heap address changes every time i run the exe on win10 64?

If you know please help.

[The trick]

Is that because of the ASLR? and if yes, i found hear By default, all VB6 apps has no ASLR / DEP protection.

Yes. All the VB6 apps, by default, has no ASLR protection but this affects only for module. Heaps and some other strucutres are randomized always.

[BD48]

Krivous,Thank You very much for reply.

but this affects only for module.

I didn't understand , do you mean DLL? or the module address in memory?
do you know a way to disable the ASLR for my process without going to the registry and effect all the system?

I appreciate your help

[The trick]

I didn't understand , do you mean DLL? or the module address in memory?

There is the special flag in the PE header IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE which means ASLR for the module is enabled, i.e. the module is loaded by the random base address. You can have the many modules and some of them have ASLR and other not, i.e. some modules have the random base addresses and others have the priority to load by the fixed address.

do you know a way to disable the ASLR for my process without going to the registry and effect all the system?

Why do you want to disable ALSR? Just the most of situations when it's needed are the exploitation of a vulnerability. What's your goal exactly?

[BD48]

I'm working on updating this tool,in Sysinternals Process Explorer you can see if the ASLR is enabled or not, and i want to add this to the project if possible.
as i mentioned before i want to disable the ASLR for my process (Current Process) for testing only i do not want to effect all the system.

There is the special flag in the PE header IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE which means ASLR for the module is enabled, i.e. the module is loaded by the random base address. You can have the many modules and some of them have ASLR and other not, i.e. some modules have the random base addresses and others have the priority to load by the fixed address.

Thank You for the information

[BD48]

I just saw here:

When you enable ASLR you also should add the relocation information to the image (/FIXED:NO).

what if i used (/FIXED:YES), is that disable the ASLR?

[The trick]

VB6 applications by default have no ASLR/DEP.

[BD48]

VB6 applications by default have no ASLR/DEP.

Thank You The Trick.