A new security bug has been discovered on Windows 8 and above which makes ASLR useless. The bug was discovered by a security researcher named Will Dormann. He explained the issue in a detailed post on CERT:

Both EMET and Windows Defender Exploit Guard enable system-wide ASLR without also enabling system-wide bottom-up ASLR. Although Windows Defender Exploit guard does have a system-wide option for system-wide bottom-up-ASLR, the default GUI value of “On by default” does not reflect the underlying registry value (unset). This causes programs without /DYNAMICBASE to get relocated, but without any entropy. The result of this is that such programs will be relocated, but to the same address every time across reboots and even across different systems.

For those who don’t know, Microsoft first implemented ASLR (Address Space Layout Randomization) in Windows Vista that helps prevent code-reuse attacks. ASLR uses a random memory address to execute code, but in Windows 8, Windows 8.1 and Windows 10 the feature is not always applied properly. In Windows 8, 8.1 and Windows 10, ASLR is not using random memory addresses, essentially rendering it useless.

Actually, with Windows 7 and EMET System-wide ASLR, the loaded address for eqnedt32.exe is different on every reboot. But with Windows 10 with either EMET or WDEG, the base for eqnedt32.exe is 0x10000 EVERY TIME.
Conclusion: Win10 cannot be enforce ASLR as well as Win7! pic.twitter.com/Jp10nqk1NQ

Open the Windows Security app by selecting the shield icon in the task bar or searching the start menu for Defender. Select the App & browser control tile (or the app icon on the left menu bar) and then select Exploit protection. This tutorial covers how to disable ASLR in your debugging VM to speed up your debugging when using x64dbg and IDA Pro.We have a short blog post here: https. In a previous blog post we explained how ASLR works on Windows. T he vast majority of this explanation still holds true through the latest version of Windows 10 (1709). In the interest of brevity, we’ll focus on the details that are relevant to the behavior observed by CERT/CC: Randomization of EXEs/DLLs is opt-in.

— Will Dormann (@wdormann) November 15, 2017

The good thing though is, Will shared a manual Registry Edit to fix the issue. For this, you need to do the following.

• Create a text file with the following:Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession Managerkernel]“MitigationOptions”=hex:00,01,01,00,00,00,00,00,00,00,00,00,00,00,00,00
• Save the file with Registry extension (.reg)
• Open Registry Editor by typing “regedit” in the Start Menu
• Select File>Import and choose the .reg file you just created.

This should be able to fix the issue until Microsoft sends an update to fix it completely.

Via: Bit-tech

Unfortunately, however, when users enable this feature system-wide, an error prevents generating enough random data to start a binary application in random memory regions. As a result, it allows users to launch attacks that reuse code. However, you can Enable the ASLR feature in Windows Defender to fix a small problem.

If ASLR does not execute after enabling it from Exploit Protection Settings, you need to properly configure the Windows Registry. However, Microsoft is expected to address this issue in upcoming patches. Until then, you can enable it by doing a Registry edit.

How to Enable ASLR in Windows Defender

The process is as follows:

Step 1: Type in notepad in the taskbar search field and press Enter. Here, create a first blank text script by entering the following text –

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Session Manager kernel]
“MitigationOptions” = hex: 00,01,01,00,00,00,00,00,00,00,00,00,00,00

Step 2: After you copy the entire text into Notepad, click File at the top, and from the submenu, choose Save as. Save this file using a .reg extension, and you can name the file as ASLR.reg.

Step 3: Go to Cortana search and type regedit command, and press Enter when you notice the same command.

Step 4: This will open Registry Editor after selecting Yes on the UAC prompt. In the Registry window, click File in the menu.

Step 5: Now, from the drop-down menu, click Import.

Step 6: Navigate to the location where you stored the reg file in Step 2 above. Select the ASLR.reg file and click the Open button to import the file.

Turn Off Aslr Windows 10

Step 7: Finally, you notice that the file you previously created with the .reg name will be imported.

Windows 10 Free Upgrade

Reboot your computer and enjoy the feature. Here’s how you can fix the error as well as Enable ASLR in Windows Defender in Windows 10.