windowsdllaslr

How to know whether a dll uses ASLR or not?


how to check whether a certain dll uses ASLR or not ?

lets take for example kernel32.dll, does it use ASLR or not ? and how to check other dlls ...

thanks ..


Solution

  • Use dumpbin.exe /headers on the DLL. The DLL characteristics will show "Dynamic base" if ASLR is enabled:

    ...
    OPTIONAL HEADER VALUES
                 10B magic # (PE32)
                9.00 linker version
               D0000 size of code
               30000 size of initialized data
                   0 size of uninitialized data
               132A3 entry point (7DD732A3)
               10000 base of code
               D0000 base of data
            7DD60000 image base (7DD60000 to 7DE6FFFF)
               10000 section alignment
               10000 file alignment
                6.01 operating system version
                6.01 image version
                6.01 subsystem version
                   0 Win32 version
              110000 size of image
               10000 size of headers
              1164FD checksum
                   3 subsystem (Windows CUI)
                 140 DLL characteristics
                       Dynamic base                    <==  Here
                       NX compatible
               40000 size of stack reserve
    ...