Didier Stevens “benchmarked” the efficiency of ALSR as implemented by the EMET tool.
The conclusion is that it is pretty weak, whereas I thought it was on pair with true ALSR (as advertised). Very instructive.
Didier Stevens “benchmarked” the efficiency of ALSR as implemented by the EMET tool.
The conclusion is that it is pretty weak, whereas I thought it was on pair with true ALSR (as advertised). Very instructive.
Microsoft published a nice tool named EMET (Enhanced Mitigation Experience Toolkit) whose purpose is to check and enforce the memory security policies such as ALSR and DEP.
It shows and allows to configure the global settings, but also, and this is the most interesting part, indicated for each process running if it supports those security measures. It is even able to enforce the protections for each application which would not support it natively (i.e. not set at compilation time).