禁用 其他程序的 DEP & ASLR

上 Code:

#include <Windows.h>
#include <ImageHlp.h>
#include <iostream>

using namespace std;
#pragma comment(lib, "ImageHlp.lib")

bool Flag(LPCSTR path, bool ASLR, bool DEP)
{
    LOADED_IMAGE PE;
    if (MapAndLoad(path, 0, &PE, 0, 0))
    {
        if (ASLR) // Enable address space layout randomization
            PE.FileHeader->OptionalHeader.DllCharacteristics |= IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE;
        else // Disable address space layout randomization
            PE.FileHeader->OptionalHeader.DllCharacteristics &= ~IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE;

        if (DEP) // Enable address space layout randomization
            PE.FileHeader->OptionalHeader.DllCharacteristics |= IMAGE_DLLCHARACTERISTICS_NX_COMPAT;
        else // Disable address space layout randomization
            PE.FileHeader->OptionalHeader.DllCharacteristics &= ~IMAGE_DLLCHARACTERISTICS_NX_COMPAT;

        UnMapAndLoad(&PE);
        return true;
    }
    return false;
}
int main()
{
    Flag("test.exe", false, false);
}

目标程序代码：

#include <stdio.h>
int main()
{
    int idx = 0;
    printf("The address of idx: 0x%p\n", &idx);
    getchar();
    return 0;
}

备注：

测试环境 Win10 1803 x64
同时，与 x64 位程序 测试效果一样。

同时 DllCharacteristics 还有如下的一些属性：
IMAGE_DLLCHARACTERISTICS_NO_SEH SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF CFG

参考：

https://docs.microsoft.com/zh-cn/windows/desktop/api/winnt/ns-winnt-_image_optional_header
https://github.com/Zer0Mem0ry/FlagEditor/blob/master/Flag.cpp