can we rebase kernel32.dll ? such that load address is different for two processes

会有一股神秘感。 提交于 2020-01-24 15:11:06

问题


specifically i want to know if kernel32.dll load address can be different for two processes within the same session ? I want to use createremote thread so just wanted to know if kernel32 load address in remote process can be different from the injecting process in any scenario ?


回答1:


Kernel32.dll has the same base address on all processes to allow exactly what you'd like to do. Read: Why are certain DLLs required to be at the same base address system-wide?




回答2:


System DLLs are loaded at random addresses (ASLRed) for security reasons so that a remote attacker can't guess where bits of code on your system are living in memory (i.e. remote attackers can't guess pointers on your computer).

This happens once per boot, and hence kernel32 will be loaded at the same address in all processes across your system.



来源:https://stackoverflow.com/questions/6732680/can-we-rebase-kernel32-dll-such-that-load-address-is-different-for-two-process

标签
易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!