cannot run executables with ASLR

[Sam Hocevar]

As of now, zzuf cannot run a .exe if it uses ASLR.

In bug #62 I put two links about defeating ALSR:

• ​http://blogs.technet.com/b/mmpc/archive/2009/06/15/bugging-the-debuggers.aspx
• ​http://www.rohitab.com/discuss/topic/34435-get-base-address-via-process-peb-and-hide-from-peb/

[Sam Hocevar]

According to the Phrack magazine article at ​http://www.phrack.org/issues.html?issue=65&id=10,

When it is wanted to create a process in suspended state it is necessary to
know which type it is [R.6]:
    - Console
    - GUI

Console type processes can be created with the API CreateProcess and the
flag CREATE_SUSPENDED.

If GUI type processes are opened with the flag CREATE_SUSPENDED may not
work correctly, so they must be created using the APIs:
    1.- CreateProcess   : Process is created without the flag
                          CREATE_SUSPENDED.
    2.- WaitForInputIdle: Correct load of the process [R.6] is waited for.
    3.- SuspendThread   : The main thread is suspended.

[xadmin]

thanks for sharing.for the phenomenal clarity in your writing.

• ​Gadgets ​asbestosis

[zohoki]

hello people, wow, this is a great discussion it was, thanks for sharing.

​youtube​facebook​seo services​blog ​blognesian