Fortunately, you can tweak the PE header of an executable to disable ASLR for that file prior to analyzing it on Windows 8.1.Ī Windows executable's PE header includes the ImageBase field, which stores the virtual memory address where the executable prefers to be loaded into memory. While it was possible to turn off ASLR on your lab system using Microsoft's Enhanced Mitigation Experience Toolkit and perhaps some registry keys on Windows 7, these approaches don't appear to work on Windows 8.1. Moreover, if you're examining a specimen that was protected with UPX, unpacking it (e.g., via 'upx -d') could produce a file that doesn't run. This can confuse and slow you down when using a debugger and a disassembler. As the result, every time you run the malicious program, you might see the same instruction being assigned different addresses. Microsoft Windows 7 and beyond appear to use ASLR by default for all processes, unless the program declares itself incompatible with this mechanism. ASLR randomizes the memory locations used by system files and other programs, making it much harder for an attacker to correctly guess the location of a given process.' Some exploits work by targeting memory locations known to be associated with particular processes. Microsoft explains that in 'older versions of Windows, core processes tended to be loaded into predictable memory locations upon system startup. IDA Pro, OllyDbg, UPX and other tools could get confused, but we can get around these issues. ASLR is good for security, but it complicates malware analysis efforts.

If you're migrating your malware lab from Windows XP, watch out for the forced ASLR feature of the operating system, especially when using Windows 8.1. Immediately apply the skills and techniques learned in SANS courses, ranges, and summits

Debugging win ollydbg and packed files