Skip to content

Instantly share code, notes, and snippets.

@utkonos
Created March 1, 2024 23:04
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save utkonos/a6db57c4df1a78e47da1550155dd6e4d to your computer and use it in GitHub Desktop.
Save utkonos/a6db57c4df1a78e47da1550155dd6e4d to your computer and use it in GitHub Desktop.
Clear ASLR Bit in PE Executable
$filePath = $args[0]
$addr_e_lfanew = 0x3c
$uint32 = 0x4
$fh = [System.IO.File]::Open($filePath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::ReadWrite)
$fh.Seek($addr_e_lfanew, [System.IO.SeekOrigin]::Begin)
$buffer = New-Object byte[] $uint32
$_ = $fh.Read($buffer, 0, $uint32)
$e_lfanew = [System.BitConverter]::ToUInt32($buffer, 0)
Write-Output $e_lfanew
$addr_dc = $e_lfanew + 0x5e
$fh.Seek($addr_dc, [System.IO.SeekOrigin]::Begin)
$buffer = New-Object byte[] $uint32
$_ = $fh.Read($buffer, 0, $uint32)
$dc = [System.BitConverter]::ToUInt32($buffer, 0)
$bitmask = -bnot 0x40
$dc_new = $dc -band $bitmask
Write-Output $dc_new
$ba = [System.BitConverter]::GetBytes($dc_new)
$fh.Seek($addr_dc, [System.IO.SeekOrigin]::Begin)
$fh.Write($ba, 0, $ba.Length)
$fh.Flush()
$fh.Close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment