Can't Stop the ROP: Automating Universal ASLR Bypasses

Bramwell Brizendine

DEF CON 33 · Day 1 · Main Stage

Address Space Layout Randomization (ASLR) has long been hailed as one of the most consequential mitigations Microsoft has deployed against memory corruption exploits on Windows. By randomizing the bas

AI review

Bramwell Brizendine demonstrates a universal, portable ASLR bypass for 64-bit Windows by abusing the Process Environment Block — always readable from user mode via GS:[0x60] — to enumerate loaded DLL base addresses without a separate information-leak primitive. Achieves 100% success across all tested Windows builds and ships automated tooling via DropRocket.

Watch on YouTube