title: ASLR and Windows System DLLs for non-aware executables?
body: <p>From a <a href="http://msdn.microsoft.com/en-us/library/bb430720.aspx" rel="nofollow">Microsoft article</a>:</p>
  
  <blockquote>
    <h2>Address Space Layout Randomization (ASLR)</h2>
    
    <p>ASLR moves executable images into random locations when a system
    boots, making it harder for exploit
    code to operate predictably. <em>For a
    component to support ASLR, all
    components that it loads must also
    support ASLR.</em> For example, if A.exe
    consumes B.dll and C.dll, all three
    must support ASLR. <em>By default, Windows
    Vista and later will randomize system
    DLLs and EXEs</em>, but DLLs and EXEs
    created by ISVs must opt in to support
    ASLR using the /DYNAMICBASE linker
    option.</p>
  </blockquote>
  
  <p>I don't quite get it. Take the base system DLLs loaded by every process on WIndows: <code>NtDll.dll</code> and <code>kernel32.dll</code>.</p>
  
  <p>If a have a <em>non-aware</em> executable, will these system DLLs use ASLR? That is, will they load at a different base address after every system reboot on Win 7 for this executable or will they always load at the same base address after system reboot like they do on Win XP?</p>
  
  <p><strong>To make it more clear what I mean:</strong> My typical dummy program's startup stack will look like this:</p>
  
  <pre><code>    write_cons.exe!wmain()  Line 8  C++
      write_cons.exe!__tmainCRTStartup()  Line 583 + 0x19 bytes   C
      write_cons.exe!wmainCRTStartup()  Line 403  C
  &gt;   kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes    
  </code></pre>
  
  <p>Looking at the asm of <code>BaseProcessStart</code>, I see on my XP box here:</p>
  
  <pre><code>_BaseProcessStart@4:
  7C817054  push        0Ch  
  7C817056  push        7C817080h 
  7C81705B  call        __SEH_prolog (7C8024D6h) 
  7C817060  and         dword ptr [ebp-4],0 
  ...
  </code></pre>
  
  <p>Now what interests me is the following:</p>
  
  <p>On Windows XP, the address will <em>always</em> be 0x7C817054, regardless of how many times I reboot this machine. If I were on Win7 with ASLR, <em>will this address change</em> between reboots if the executable that loads kernel32.dll is <em>not</em> enabled for ASLR?</p>
  
  <p>(Note: For me, atm., there is only one minor use-case this address would be useful for: In Visual Studio, I can only set a "Data Breakpoint" for assembly level functions, that is a breakpoint @ 0x7... - If I want to break in a specific ntdll.dll or kernel32.dll function, in Windows XP I do not have to adjust my breakpoints between reboots. With ASLR kicking in (the scope of this question) I would have to change the Data Breakpoints between reboots.)</p>