[ANY] Add ASLR, DEP protection to VB6 apps or any, Terminal Server aware flags

[Dragokas]

Hi,

it's a console application to patch executable.

Using:

1) open with notepad your app.vbp (main project file of your program) and append to the end:

[VBCompiler]
LinkSwitches="/FIXED:NO"

2) compile your program.
3) unpack and compile TSAware_c.vbp from archive below.
4) from command line (or .bat file) execute:

TSAwarePatch.exe "path\to\your\program.exe"

What does he do:
- Instruct compiler to generate a relocation section (required by ASLR)
Adds:
- ASLR (IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE)
- DEP (IMAGE_DLLCHARACTERISTICS_NX_COMPAT)
- TSAWARE (IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE)
flags to DllCharacteristics field of Optional Image header
- correct PE checksum.

Detail description:
By default, all VB6 apps has no ASLR / DEP protection. What is it, you can read somewhere else. You can check your app e.g. using Process Hacker.
I'll stop a little bit about TSAWARE:

When you run your app in Windows Server with installed Terminal services some API have unusual behaviour. You can read more in this MSDN article.
If you sure your app meets all requirements stated in above article, to ensure your app will not be virtualized in that way, you must add TS awareness.
And, just a little experiment:
- install terminal sevices (or, here is full instruction in Russian)
- run in console:

change user /execute

- reboot
- execute GetWindowsDirectory() API, SHGetFolderPath() or SHGetKnownFolderPath() and you will get C:\Users\Username\WINDOWS instead of C:\WINDOWS until set flag or use something like GetSystemWindowsDirectory() API.

Also, to add TS awareness you can add flag to linker, in .vbp:

[VBCompiler]
LinkSwitches="/TSAWARE"

Download attachment: in this post.

Good luck,
Stanislav.