I am having a problem running mshta.exe
. As you can see in the picture below, I get the error: The system cannot execute the specified program.
I've created a test.hta
file and it can't be executed as well. I've tried these solutions and none of them worked:
Yet, when I enabled the ASLR
it worked!
I've edited the registry value MoveImages
to 1. It's under the key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession ManagerMemory Management
. I've disabled the ASLR before because sometimes I debug DLLs.
My question is: Why did this work? How can the ASLR help with this problem?
A friend of mine has one interesting answer I want to share:
"Its error from within the kernel of NtCreateUserProcess
, in this api, there're calls to ZwMapViewOfSection
to map executable image to memory. In our case the MapView returns STATUS_CONFLICTING_ADDRESSES
.
If you read the ZwMapViewOfSection
docs, you will see that Windows cache some address range, so that if an image without ASLR requesting address within the cache, it fails at ZwMapViewOfSection
.
This wont happen with ASLR because Windows will guarantee the new image base address wont be inside any cache range".