Can't Stop the ROP: Automating Universal ASLR Bypasses
Bramwell Brizendine
DEF CON 33 · Day 1 · Main Stage
Address Space Layout Randomization (ASLR) has long been hailed as one of the most consequential mitigations Microsoft has deployed against memory corruption exploits on Windows. By randomizing the bas
AI review
Bramwell Brizendine demonstrates a universal, portable ASLR bypass for 64-bit Windows by abusing the Process Environment Block — always readable from user mode via GS:[0x60] — to enumerate loaded DLL base addresses without a separate information-leak primitive. Achieves 100% success across all tested Windows builds and ships automated tooling via DropRocket.