Bug Hunter Diary

Detecting Exploit Mitigation TechniquesBefore you can try to circumvent these mitigation techniques, youhave to determine which ones an application or a running processactually uses.Mitigations can be controlled by system policy, by special APIs,and by compile-time options. For example, the default system-wideDEP policy for Windows client–operating systems is called OptIn. Inthis mode of operation, DEP is enabled only for processes that explicitlyopt in to DEP. There are different ways to opt a process in to DEP. Forexample, you could use the appropriate linker switch (/NXCOMPAT)at compile time, or you could use the SetProcessDEPPolicy API to allowan application to opt in to DEP programmatically. Windows supportsfour system-wide configurations for hardware-enforced DEP. 5 On WindowsVista and later, you can use the bcdedit.exe console applicationto verify the system-wide DEP policy, but this must be done from anelevated Windows command prompt. To verify the DEP and ASLR settingsof an application, you can use Sysinternals’s Process Explorer. 6NoteTo configure Process Explorer so that it shows the processes’ DEP andASLR status, add the following columns to the view: View4SelectColumns4DEP Status and View4Select Columns4ASLR Enabled.Additionally, set the lower pane to view DLLs for a process and addthe “ASLR Enabled” column to the view (see Figure C-1).The newer versions of Windows (Vista or later) also support ASLRby default, but the DLLs and EXEs must opt in to support ASLR usingthe /DYNAMICBASE linker option. It is important to note that protectionis significantly weaker if not all modules of a process opt in toASLR. In practice, the effectiveness of mitigations like DEP and ASLRis heavily dependent on how completely each mitigation technologyhas been enabled by an application. 7Figure C-1 shows an example of Process Explorer being used toobserve the DEP and ASLR settings of Internet Explorer. Note thatthe Java DLLs that have been loaded into the context of InternetExplorer do not make use of ASLR (denoted by an empty value forthe ASLR column in the lower pane). Microsoft has also releaseda tool called BinScope Binary Analyzer, 8 which analyzes binaries for awide variety of security protections with a straightforward, easy-to-useinterface.If both DEP and ASLR are correctly deployed, exploit developmentis a lot harder.To see if a Windows binary supports the security cookie (/GS)mitigation technique, you can disassemble the binary with IDA Proand look for references to the security cookie in the function epilogueand prologue, as shown in Figure C-2.Mitigation 181