{"id":100,"date":"2006-12-16T02:39:21","date_gmt":"2006-12-16T07:39:21","guid":{"rendered":"http:\/\/www.nynaeve.net\/?p=100"},"modified":"2019-12-13T17:39:34","modified_gmt":"2019-12-13T22:39:34","slug":"vista-aslr-is-not-on-by-default-for-image-base-addresses","status":"publish","type":"post","link":"http:\/\/www.nynaeve.net\/?p=100","title":{"rendered":"Vista ASLR is not on by default for image base addresses"},"content":{"rendered":"

This little tidbit seems to be missed in all of the press about Vista’s ASLR implementation: Vista ASLR (when speaking of randomizing image base addresses) does not apply to image bases by default. This is a sacrifice for application compatibility’s sake, in an effort to make fewer programs break “out of the box” on Vista. Most notably, this is the case even for images with base relocations<\/em>.<\/p>\n

Unfortunately, the mechanism to mark an executable image as “ASLR aware” (such that it can be freely rebased by Vista’s ASLR) is not at present documented. Furthermore, the linker version that is included with Visual Studio 2005 and the Windows Vista Platform SDK does not support the option necessary to mark as image as ASLR aware (though you could technically modify the image by hand with a hex editor or the like to enable it).<\/p>\n

The WDK linker does support the new ASLR-enabling linker option, however (though it too does not appear to document it anywhere). You can find references to this new linker option in makefile.new<\/em>:<\/p>\n

!if defined(NO_DYNAMICBASE)\r\nDYNAMICBASE_FLAG=\r\n!else\r\n! if $(_NT_TOOLS_VERSION) >= 0x800\r\nDYNAMICBASE_FLAG=\/dynamicbase\r\n! else\r\nDYNAMICBASE_FLAG=\r\n! endif\r\n!endif\r\n<\/pre>\n
Passing \/dynamicbase to the WDK version of link.exe (8.00.50727.215) or later will set the 0x40 DllCharacteristics value in the PE header of the output binary.  This corresponds to a newly-defined constant which is at present only documented briefly in the WDK version of ntimage.h:<\/p>\n
#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040\r\n     \/\/ DLL can move.<\/pre>\n
If this flag is set, then the base address of an image can be randomized by Vista’s ASLR; if the flag is clear, however, then no ASLR-style randomizations are performed to the image base address of a particular image (in this case, however, it is important to note that heap and stack allocations are still randomized – it is only the image base address that does not become randomized).<\/p>\n
Now, virtually all of the Microsoft PE images that ship with the operating system are built with \/dynamicbase, so they will take full advantage of Vista’s ASLR with respect to image base randomization.  However, third party (ISV)-built programs will not, by default, gain all the benefits of ASLR due to this application compatibility sacrifice.  This is where the potential problem is, as effectively all existing third party PE images will need to be recompiled to enable ASLR on image base addresses.  (Technically, you could use link \/edit with the WDK linker to do this without a rebuild, or hex edit binaries, but this is not a real solution in my mind.  In Microsoft’s defense, many third-party .exe files are often built without base relocations, which means that even if Microsoft had enabled ASLR by default, many third party programs would still not be getting the full benefit.  This does not, however, mean that I fully agree with their decision…)<\/p>\n
I can understand where Microsoft is coming from with an application compatibility perspective as far as ASLR’s impact on poorly written programs (of which there are an abundance of in the Windows world), but it is a bit unfortunate that there is no real way to administratively enable ASLR globally, or at least administratively make it an opt-out instead of opt-in setting.<\/p>\n
So, if you are an ISV, here’s a heads up to be on the lookout for a link.exe version shipping with Visual Studio that supports \/dynamicbase.  When such becomes available, I would highly recommend enabling \/dynamicbase for all of your projects (so long as you aren’t doing anything terribly stupid in your programs, enabling image base randomizations should be fairly harmless in most cases).  You should also mark your .exe files as \/FIXED:NO such that they contain a relocation section.  This, when combined with \/dynamicbase, will allow your .exe files to be randomized by ASLR (just the same as with DLLs that have relocation information and are built with \/dynamicbase).<\/p>\n
Update: Visual Studio 2005 SP1<\/a> has shipped.  This update to Visual Studio includes a newer version of the linker, which supports the \/dynamicbase option described above.  So, be sure to rebuild your programs with \/dynamicbase and \/fixed:no with VS 2005 SP1 in order to take full advantage of ASLR on Vista.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"
This little tidbit seems to be missed in all of the press about Vista’s ASLR implementation: Vista ASLR (when speaking of randomizing image base addresses) does not apply to image bases by default. This is a sacrifice for application compatibility’s sake, in an effort to make fewer programs break “out of the box” on Vista. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4,3,5],"tags":[],"_links":{"self":[{"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/posts\/100"}],"collection":[{"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=100"}],"version-history":[{"count":1,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/posts\/100\/revisions"}],"predecessor-version":[{"id":621,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/posts\/100\/revisions\/621"}],"wp:attachment":[{"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=100"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=100"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}