Sometimes when you’re attaching IDA to a process, you’ll get:
This can be especially annoying if you’re working with a large binary - it takes a while. It’s usually caused by Address space layout randomization, which is enabled by the linker using the
Essentially all this does is set the
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE flag in the
DllCharacteristics word in
IMAGE_OPTIONAL_HEADER. You can fairly easily disable it yourself, but Microsoft makes it easy for us. Open up a VS command prompt and use:
$ link /edit /dynamicbase:NO filename.exe
And ASLR is off. No more rebasing.