windowsoperating-systemreverse-engineeringhtaaslr

What is the relation between ASLR and the mshta.exe's error "The system cannot execute the specified program"?


I am having a problem running mshta.exe. As you can see in the picture below, I get the error: The system cannot execute the specified program.

I've created a test.hta file and it can't be executed as well. I've tried these solutions and none of them worked:

  1. I've disabled App Locker
  2. I've disabled the Anti-virus
  3. I've turned off windows firewall.

Yet, when I enabled the ASLR it worked! I've edited the registry value MoveImages to 1. It's under the key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession ManagerMemory Management. I've disabled the ASLR before because sometimes I debug DLLs.

My question is: Why did this work? How can the ASLR help with this problem?

test hta file


Solution

  • A friend of mine has one interesting answer I want to share:

    "Its error from within the kernel of NtCreateUserProcess, in this api, there're calls to ZwMapViewOfSection to map executable image to memory. In our case the MapView returns STATUS_CONFLICTING_ADDRESSES. If you read the ZwMapViewOfSection docs, you will see that Windows cache some address range, so that if an image without ASLR requesting address within the cache, it fails at ZwMapViewOfSection. This wont happen with ASLR because Windows will guarantee the new image base address wont be inside any cache range".