shellcode写入的随机基址处理

昨天写完shellcode任意节写入时，我想测试文件对齐与内存对齐不一样的文件能不能成功（因为我实在找不到一个可以提供我测试的软件，很多软件没有用user32这个dll，其他的我也还没学），于是自己写了一个仅调用了messagebox的函数，结果没有成功，我以为是我的imagebuffer没有处理好，结果拖进od计算才发现，我的e8后面的地址算错了，e9却对了，

PVOID e8Addr = (DWORD)MessageBoxA - (pOptHeader->ImageBase + pSecHeader->VirtualAddress 
+ pSecHeader->Misc.PhysicalAddress + 8 + 5); 

PVOID e9Addr = pOptHeader->AddressOfEntryPoint - (pSecHeader->VirtualAddress + pSecHeader-
>Misc.PhysicalAddress + 8 + 5 + 5);

答案就非常的显而易见，两条公式仅仅相差了一个imagebase，经过一番搜寻，学习发，vs后面版本的软件都是自带随机基址的，所以就需要手动去关掉这个随机基址

typedef struct _IMAGE_OPTIONAL_HEADER {
    //
    // Standard fields.
    //

    WORD    Magic;
    BYTE    MajorLinkerVersion;
    BYTE    MinorLinkerVersion;
    DWORD   SizeOfCode;
    DWORD   SizeOfInitializedData;
    DWORD   SizeOfUninitializedData;
    DWORD   AddressOfEntryPoint;
    DWORD   BaseOfCode;
    DWORD   BaseOfData;

    //
    // NT additional fields.
    //

    DWORD   ImageBase;
    DWORD   SectionAlignment;
    DWORD   FileAlignment;
    WORD    MajorOperatingSystemVersion;
    WORD    MinorOperatingSystemVersion;
    WORD    MajorImageVersion;
    WORD    MinorImageVersion;
    WORD    MajorSubsystemVersion;
    WORD    MinorSubsystemVersion;
    DWORD   Win32VersionValue;
    DWORD   SizeOfImage;
    DWORD   SizeOfHeaders;
    DWORD   CheckSum;
    WORD    Subsystem;
    WORD    DllCharacteristics;  //这就是我们需要改的地方
    DWORD   SizeOfStackReserve;
    DWORD   SizeOfStackCommit;
    DWORD   SizeOfHeapReserve;
    DWORD   SizeOfHeapCommit;
    DWORD   LoaderFlags;
    DWORD   NumberOfRvaAndSizes;
    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

需要看到这个字节掌控了很多权限，但是网络上看的视频却没有把这个属性标红

DllCharacteristics：DLL的文件属性，只对DLL文件有效，可以是下面定义中某些的组合：

// DllCharacteristics Entries

//      IMAGE_LIBRARY_PROCESS_INIT            0x0001     // Reserved.
//      IMAGE_LIBRARY_PROCESS_TERM            0x0002     // Reserved.
//      IMAGE_LIBRARY_THREAD_INIT             0x0004     // Reserved.
//      IMAGE_LIBRARY_THREAD_TERM             0x0008     // Reserved.
#define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA    0x0020  // Image can handle a high entropy 64-bit virtual address space.
#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040     // DLL can move.
#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY    0x0080     // Code Integrity Image
#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT    0x0100     // Image is NX compatible
#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200     // Image understands isolation and doesn't want it
#define IMAGE_DLLCHARACTERISTICS_NO_SEH       0x0400     // Image does not use SEH.  No SE handler may reside in this image
#define IMAGE_DLLCHARACTERISTICS_NO_BIND      0x0800     // Do not bind this image.
#define IMAGE_DLLCHARACTERISTICS_APPCONTAINER 0x1000     // Image should execute in an AppContainer
#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER   0x2000     // Driver uses WDM model
#define IMAGE_DLLCHARACTERISTICS_GUARD_CF     0x4000     // Image supports Control Flow Guard.
#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE     0x8000

最后关掉，shellcode就能工作了

	//关闭随机基址
	pOptHeader->DllCharacteristics &= (~IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE);

gg