Nytro Posted May 1, 2013 Report Posted May 1, 2013 [h=3]Windbg Tricks - Module Relocation[/h]When ASLR is not supported, pseudo ASLR is often used to introduce a degree of entropy in where the module is loaded into memory.The basic idea behind pseudo ASLR is to pre-allocate memory at the location of a module's preferred base address. This forces the module to be loaded at a non-predetermined address. See this for more details.I stumbled across the windbg command !imgreloc the other day. It can be used to show all modules that have been relocated, and what their original preferred base address is.Below is the output when run while attached to firefox.exe (see this ticket about dll blocking and this firefox ticket for a specific history of pseudo ASLR in firefox):0:017> !imgreloc00280000 sqlite3 - RELOCATED from 1000000000300000 js3250 - RELOCATED from 1000000000400000 firefox - at preferred address004e0000 nspr4 - RELOCATED from 1000000000510000 smime3 - RELOCATED from 1000000000530000 nss3 - RELOCATED from 10000000005d0000 nssutil3 - RELOCATED from 10000000005f0000 plc4 - RELOCATED from 1000000000600000 plds4 - RELOCATED from 1000000000610000 ssl3 - RELOCATED from 1000000000640000 xpcom - RELOCATED from 1000000001220000 browserdirprovider - RELOCATED from 1000000001540000 brwsrcmp - RELOCATED from 1000000001de0000 nssdbm3 - RELOCATED from 1000000002000000 xpsp2res - RELOCATED from 00010000036a0000 softokn3 - RELOCATED from 1000000003980000 freebl3 - RELOCATED from 10000000039d0000 nssckbi - RELOCATED from 1000000010000000 xul - at preferred address59a60000 dbghelp - at preferred address5ad70000 uxtheme - at preferred address0:017> .shell -ci "!imgreloc" findstr RELOCATED00280000 sqlite3 - RELOCATED from 1000000000300000 js3250 - RELOCATED from 10000000004e0000 nspr4 - RELOCATED from 1000000000510000 smime3 - RELOCATED from 1000000000530000 nss3 - RELOCATED from 10000000005d0000 nssutil3 - RELOCATED from 10000000005f0000 plc4 - RELOCATED from 1000000000600000 plds4 - RELOCATED from 1000000000610000 ssl3 - RELOCATED from 1000000000640000 xpcom - RELOCATED from 1000000001220000 browserdirprovider - RELOCATED from 1000000001540000 brwsrcmp - RELOCATED from 1000000001de0000 nssdbm3 - RELOCATED from 1000000002000000 xpsp2res - RELOCATED from 00010000036a0000 softokn3 - RELOCATED from 1000000003980000 freebl3 - RELOCATED from 10000000039d0000 nssckbi - RELOCATED from 10000000Searching for preferred instead of RELOCATED will yield a list of modules that should remain at their preferred address (and thus be usable for ROP or other such techniques). Posted by d0c.s4vageSursa: d0c_s4vage: Windbg Tricks - Module Relocation Quote
