Exploiting memory corruption issues using a DLL file

Question

I was listening to a talk on Return Oriented Exploitation from the Black Hat 2010 conference. The speaker mentioned something about using the DLLs to exploit some of the memory corruption issues.

I know that the DLLs are loaded into the memory only if required by a certain program. But, are they always loaded into some static address range or at any particular memory address? Because, if every time these DLLs are loaded in some random memory address, it'll be really difficult to exploit the memory. (Please correct me if my assumptions are incorrect)

Anyone here with any insights of how this can be done? Is it even possible to exploit the memory vulnerabilities using DLLs?

Answer 1

Depending on how they were compiled, most DLLs use ASLR (http://en.wikipedia.org/wiki/Address_space_layout_randomization). Some do not, so this makes them easy to exploit. If there is some sort of information leak (printing out a function pointer or something), then the randomization doesn't matter because the attacker knows the randomized address.