Bypass Address Space Layout Randomization (ASLR)

DLL Characteristics

To know if a PE file will use ASLR, you can check the DLL Characteristics in the Optional Header PE headers. If the field contains the value 0x0040( cf Microsoft Documentation - DLL characteristics), it means that the image base address can be relocated at load time.

For example, if we check with PE-bear:

Rebase in Ghidra

If you are working on a sample in both a debugger and a disassembler, you can modify the image base address of the binary in the disassembler to have the same alignment than the one from memory found in the debugger.

First, find the virtual address in the debugger. In x64dbg, go to Memory Map, and then find the address related to the name of the sample:

In Ghidra, go to Window -> Memory Map:

Then click on the Home icon and specify the address in the new window:

Disable ASLR at Operating System level

In Windows, you can disable ALSR by going into the Exploit Protection security settings windows and disable all ASLR related settings:

References

• Microsoft Documentation - DLL characteristics
• OALabs - Disable ASLR For Easier Malware Debugging With x64dbg and IDA Pro
• Six Facts about Address Space Layout Randomization on Windows
• Windows Malware Analysis for Hedgehogs - Beginner Training