From: André Hentschel Subject: ntdll: Randomize security cookie when available (try 5) Message-Id: <5592DCDF.60001@dawncrow.de> Date: Tue, 30 Jun 2015 20:15:59 +0200 --- dlls/ntdll/virtual.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/dlls/ntdll/virtual.c b/dlls/ntdll/virtual.c index bc3f7cd..1a7ce2c 100644 --- a/dlls/ntdll/virtual.c +++ b/dlls/ntdll/virtual.c @@ -1278,6 +1278,24 @@ static NTSTATUS map_image( HANDLE hmapping, int fd, char *base, SIZE_T total_siz } } + + /* randomize security cookie */ + + if (IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG < nt->OptionalHeader.NumberOfRvaAndSizes && + (pos = nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].VirtualAddress)) + { + IMAGE_LOAD_CONFIG_DIRECTORY *loadcfg = (IMAGE_LOAD_CONFIG_DIRECTORY *)(ptr + pos); + ULONG_PTR *cookie = (ULONG_PTR *)loadcfg->SecurityCookie; + ULONG seed = NtGetTickCount(); + + *cookie = RtlRandom( &seed ); +#ifdef _WIN64 + /* Fill up, but keep the highest word clear */ + *cookie ^= (ULONG_PTR)RtlRandom( &seed ) << 16; +#endif + } + + /* set the image protections */ VIRTUAL_SetProt( view, ptr, ROUND_SIZE( 0, header_size ), VPROT_COMMITTED | VPROT_READ ); -- 1.9.1