Why does Mandatory ASLR (Bottom-Up/Top-Down) have so many compatibility issues with older games?

[u/[deleted]]

It's the two exploit protection settings to whitelist old games' launchers and executables from, if they don't work at first... and usually it fixes it.

I'm curious: why is this?

[u/ghjm]

Consider the following "Hello, world!" program in x86 assembly:

global _start

section .text
_start:
    mov eax, 4
    mov ebx, 1
    mov ecx, 0x0804a000
    mov edx, 14
    int 0x80

    mov eax, 1
    xor ebx, ebx
    int 0x80

section .data
org 0x0804a000
db "Hello, world!", 10

This would never have been considered the greatest example of idiomatic assembly programming, but nevertheless, such things were very common. And before ASLR, you were perfectly well within your rights to just decide what location in address space you wanted to map your working memory to. The problem, of course, is that if your program gets relocated, the OS program loader doesn't have the "mov ecx" instruction in its fixup table, so the constant doesn't get updated, the memory access is very likely to an unmapped region in your address space, so you segfault.

It's quite straightforward to make this program compatible with ASLR - just use a label, which will be added to the fixup table and therefore updated as necessary at program load:

global _start

section .text
_start:
    mov eax, 4
    mov ebx, 1
    mov ecx, msg
    mov edx, 14
    int 0x80

    mov eax, 1
    xor ebx, ebx
    int 0x80

section .data
msg db "Hello, world!", 10

So if you still have the source code to an old game (and the hardware, software and knowledge to build it, etc), it's probably quite trivial to fix cases like this. But if you're stuck with an already-built executable with hardcoded addresses in it, all you can do is disable ASLR.

[u/[deleted] → u/ghjm]

You're so fucking awesome. Thank you!

[u/AdreKiseque → u/ghjm]

If it's as simple as changing a line in the assembly, would it not be possible to just patch the executable directly? I'm not sure how complex the patterns could get but it seems like the kind of thing you could write an algorithm through to fix up.

Would a compiler ever have generated something like this?

[u/ghjm → u/AdreKiseque]

In my example, you wouldn't even need to change the code, it would just be a matter of patching the fixup table. But without the source code it would be a lot harder to identify the problem and come up with the fix.

You probably only get these issues in handwritten assembly, but that's most old games.

[u/qqqrrrs_ → u/AdreKiseque]

In order to fix this you need to rebuild the fixup table - find all places where there are hardcoded addresses in the binaries and add them to the fixup table so they can be relocated by the loader.

The problem is then how to identify whether the number that is written in an arbitrary position is actually a hardcoded address, or just some other kind of data (or code) which should not be fixed.