上 Code:
#include <Windows.h>
#include <ImageHlp.h>
#include <iostream>
using namespace std;
#pragma comment(lib, "ImageHlp.lib")
bool Flag(LPCSTR path, bool ASLR, bool DEP)
{
LOADED_IMAGE PE;
if (MapAndLoad(path, 0, &PE, 0, 0))
{
if (ASLR) // Enable address space layout randomization
PE.FileHeader->OptionalHeader.DllCharacteristics |= IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE;
else // Disable address space layout randomization
PE.FileHeader->OptionalHeader.DllCharacteristics &= ~IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE;
if (DEP) // Enable address space layout randomization
PE.FileHeader->OptionalHeader.DllCharacteristics |= IMAGE_DLLCHARACTERISTICS_NX_COMPAT;
else // Disable address space layout randomization
PE.FileHeader->OptionalHeader.DllCharacteristics &= ~IMAGE_DLLCHARACTERISTICS_NX_COMPAT;
UnMapAndLoad(&PE);
return true;
}
return false;
}
int main()
{
Flag("test.exe", false, false);
}
目标程序代码:
#include <stdio.h>
int main()
{
int idx = 0;
printf("The address of idx: 0x%p\n", &idx);
getchar();
return 0;
}
备注:
测试环境 Win10 1803 x64
同时,与 x64 位程序 测试效果一样。
同时 DllCharacteristics 还有如下的一些属性:
IMAGE_DLLCHARACTERISTICS_NO_SEH SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF CFG
参考:
https://docs.microsoft.com/zh-cn/windows/desktop/api/winnt/ns-winnt-_image_optional_header
https://github.com/Zer0Mem0ry/FlagEditor/blob/master/Flag.cpp