WS2008: Dynamic Link Library Loader and Address Space Load Randomization

WS2008: Dynamic Link Library Loader and Address Space Load … at Relocation Services and Moving Companies Blog

Wed, 06 Feb 2008 15:36:13 GMT

PingBack from http://www.relocationmax.com/blog/2008/02/06/ws2008-dynamic-link-library-loader-and-address-space-load/

re: WS2008: Dynamic Link Library Loader and Address Space Load Randomization

Matt — Thu, 07 Feb 2008 00:47:53 GMT

I can never seem to find a definitive answer to this question: does ASLR require x64, or does it work on x86 as well?

re: WS2008: Dynamic Link Library Loader and Address Space Load Randomization

fariano — Thu, 07 Feb 2008 16:16:08 GMT

ASLR is enabled in both 32 and 64 bit versions. It's a memory allocation strategy, so it's independent by CPU.

re: WS2008: Dynamic Link Library Loader and Address Space Load Randomization

luca — Thu, 07 Feb 2008 16:17:26 GMT

can I show ASLR state with Windows Vista's task manager? Is the task manager updated in Vista SP1 ?

re: WS2008: Dynamic Link Library Loader and Address Space Load Randomization

FredAtMicrosoft — Mon, 11 Feb 2008 18:30:24 GMT

If any of you are interested in attending the Heroes Happen Here launch events they're free to attend and you get a free version of Windows Server 2008 Enterprise Edition.

--------------------------------

Fred Reckling

Microsoft 2008 Joint Launch Team

http://www.microsoft.com/2008jointlaunch/

re: WS2008: Dynamic Link Library Loader and Address Space Load Randomization

Gary Scheitlin — Tue, 24 Jun 2008 22:21:58 GMT

What tool did you use to get the comparison reports?

(Name .. Base, image base, etc.)

re: WS2008: Dynamic Link Library Loader and Address Space Load Randomization

molotov — Wed, 25 Jun 2008 05:18:30 GMT

Hi Gary,

The screenshot appears to be Process Explorer, available from http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx.

re: WS2008: Dynamic Link Library Loader and Address Space Load Randomization

Mark Prigg — Tue, 22 Jul 2008 13:50:00 GMT

The memory optimisation used by RTO TScale or Citrix XenApp employs a DLL rebasing mechanism which uses a DLL’s alternate data stream to tell the DLL to load into a memory address space not occupied by another DLL. It knows in advance the address space to allocate from observing DLL loading behaviour and OS repointing. The means that DLL collisions are rare, and with this goes the overhead of Windows having to move a DLL into a different memory address space, which is an intense operation and because most DLLs launch at application-load-time, means applications can load slower.

Now, does Windows 2008’s ‘Address Space Load Randomization’ technology actually render DLL rebasing \ memory optimisation, LESS relevant or MORE relevant? ASLR allows a DLL to load into a randomly allocated memory address space (choice of 256 to use), with the idea being that Malware cannot guess a DLLs address space and move into it.

Is the allocation of a random memory address space also factoring collisions?

Will there be more or less collisions?

Is it tagging onto the old memory re-allocation-on-collision technology?

DLL rebasing can confidently predict what OS memory address space to use because it is pretty consistent, but original loads and OS re-pointed loads can use random addresses. So TScale will need to change them frequently. But will there be collisions anyway?