¿Cómo puedo detectar (o inventariar) todas las DLL que no usan ASLR?

Si solo desea saber si una DLL es compatible con ASLR, luego cárguela en CFF Explorer , vaya a la Opcional Sección de encabezado, luego haga clic en la fila DllCharacteristics . Si se marca "DLL se puede mover", entonces está habilitado para ASLR, de lo contrario no lo está.

Si desea hacer un montón de ellos, escribiría un script de Python que enumera todos los archivos DLL en un directorio de destino, luego los verifica utilizando pefile módulo. Esto le da acceso a todo tipo de información, incluido el campo DllCharacteristics del encabezado de PE, que puede verificar para ver si IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE está configurado. Eso te dirá si está habilitado para ASLR o no.

En cuanto a evitar que se carguen, no hay mucho que puedas hacer. Sin embargo, puede usar EMET para establecer ASLR obligatorio en un proceso para exigir que cada DLL cargado tenga ASLR habilitado, independientemente de si está configurado en el archivo PE o no.

Gracias a @Polynomial por esa excelente sugerencia de módulo pefile . Hice un guión rápido de python para hacer esto. Probablemente haya espacio para mejoras pero parece funcionar bastante bien.

import argparse
import os
import pefile


class DllCharacteristics():
    def __init__(self):
        self.IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = False
        self.IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = False
        self.IMAGE_DLLCHARACTERISTICS_NO_BIND = False
        self.IMAGE_DLLCHARACTERISTICS_NO_SEH = False
        self.IMAGE_DLLCHARACTERISTICS_NO_ISOLATION = False
        self.IMAGE_DLLCHARACTERISTICS_NX_COMPAT = False
        self.IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY = False
        self.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = False


def get_dll_characteristics(path):
    foo = DllCharacteristics()

    pe = pefile.PE(path, fast_load=True)
    dll_characteristics = pe.OPTIONAL_HEADER.DllCharacteristics

    if dll_characteristics > 0:
        if dll_characteristics >= 32768:
            foo.IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = True
            dll_characteristics -= 32768

        if dll_characteristics >= 8192:
            foo.IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = True
            dll_characteristics -= 8192

        if dll_characteristics == 2048 or dll_characteristics > 2080:
            foo.IMAGE_DLLCHARACTERISTICS_NO_BIND = True
            dll_characteristics -= 2048

        if dll_characteristics == 1024 or dll_characteristics > 1056:
            foo.IMAGE_DLLCHARACTERISTICS_NO_SEH = True
            dll_characteristics -= 1024

        if dll_characteristics == 512 or dll_characteristics > 544:
            foo.IMAGE_DLLCHARACTERISTICS_NO_ISOLATION = True
            dll_characteristics -= 512

        if dll_characteristics == 256 or dll_characteristics > 288:
            foo.IMAGE_DLLCHARACTERISTICS_NX_COMPAT = True
            dll_characteristics -= 256

        if dll_characteristics >= 128:
            foo.IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY = True
            dll_characteristics -= 128

        if dll_characteristics == 64:
            foo.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = True
            dll_characteristics -= 64

    return foo


if __name__ == '__main__':

    parser = argparse.ArgumentParser()
    parser.add_argument('dir', help='Directory to scan')
    args = parser.parse_args()

    dep_enabled = []
    dep_disabled = []

    aslr_enabled = []
    aslr_disabled = []

    for root, dirs, files in os.walk(args.dir):
        for f in files:
            bar = get_dll_characteristics(os.path.join(root, f))

            if bar.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE:
                aslr_enabled.append(f)
            else:
                aslr_disabled.append(f)

            if bar.IMAGE_DLLCHARACTERISTICS_NX_COMPAT:
                dep_enabled.append(f)
            else:
                dep_disabled.append(f)

    print "ASLR Enabled: "
    print "=============="
    for i in aslr_enabled:
        print i
    print ""

    print "ASLR Disabled: "
    print "==============="
    for i in aslr_disabled:
        print i
    print ""

    print "DEP Enabled: "
    print "============="
    for i in dep_enabled:
        print i
    print ""

    print "DEP Disabled: "
    print "=============="
    for i in dep_disabled:
        print i
    print ""

5 años después, modifiqué el código provisto por @Ayrx usando el operador & para probar las banderas como sugirió @avakar. Ahora funciona correctamente:

import argparse
import os
import pefile

class DllCharacteristics():
    def __init__(self):
        self.IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = False
        self.IMAGE_DLLCHARACTERISTICS_GUARD_CF = False
        self.IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = False
        self.IMAGE_DLLCHARACTERISTICS_APPCONTAINER = False
        self.IMAGE_DLLCHARACTERISTICS_NO_BIND = False
        self.IMAGE_DLLCHARACTERISTICS_NO_SEH = False
        self.IMAGE_DLLCHARACTERISTICS_NO_ISOLATION = False
        self.IMAGE_DLLCHARACTERISTICS_NX_COMPAT = False
        self.IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY = False
        self.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = False
        self.IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA = False

def has_flag(value, flag):
    return value & flag == flag

def get_dll_characteristics(path):
    dc = DllCharacteristics()

    pe = pefile.PE(path, fast_load=True)
    dll_characteristics = pe.OPTIONAL_HEADER.DllCharacteristics

    if dll_characteristics > 0:
        dc.IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = has_flag(dll_characteristics, 0x8000)
        dc.IMAGE_DLLCHARACTERISTICS_GUARD_CF = has_flag(dll_characteristics, 0x4000)
        dc.IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = has_flag(dll_characteristics, 0x2000)
        dc.IMAGE_DLLCHARACTERISTICS_APPCONTAINER = has_flag(dll_characteristics, 0x1000)
        dc.IMAGE_DLLCHARACTERISTICS_NO_BIND = has_flag(dll_characteristics, 0x0800)
        dc.IMAGE_DLLCHARACTERISTICS_NO_SEH = has_flag(dll_characteristics, 0x0400)
        dc.IMAGE_DLLCHARACTERISTICS_NO_ISOLATION = has_flag(dll_characteristics, 0x0200)
        dc.IMAGE_DLLCHARACTERISTICS_NX_COMPAT = has_flag(dll_characteristics, 0x0100)
        dc.IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY = has_flag(dll_characteristics, 0x0080)
        dc.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = has_flag(dll_characteristics, 0x0040)
        dc.IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA = has_flag(dll_characteristics, 0x0020)

    return dc


if __name__ == '__main__':

    parser = argparse.ArgumentParser()
    parser.add_argument('dir', help='Directory to scan')
    args = parser.parse_args()

    dep_enabled = []
    dep_disabled = []

    aslr_enabled = []
    aslr_disabled = []

    for root, dirs, files in os.walk(args.dir):
        for f in files:
            flags = get_dll_characteristics(os.path.join(root, f))

            if flags.IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE:
                aslr_enabled.append(f)
            else:
                aslr_disabled.append(f)

            if flags.IMAGE_DLLCHARACTERISTICS_NX_COMPAT:
                dep_enabled.append(f)
            else:
                dep_disabled.append(f)

    print "ASLR Enabled: "
    print "=============="
    for i in aslr_enabled:
        print i
    print ""

    print "ASLR Disabled: "
    print "==============="
    for i in aslr_disabled:
        print i
    print ""

    print "DEP Enabled: "
    print "============="
    for i in dep_enabled:
        print i
    print ""

    print "DEP Disabled: "
    print "=============="
    for i in dep_disabled:
        print i
    print ""