Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been hearing this word the whole day long. Can any one give me a brief intro? How does it differ from ASLR?

share|improve this question
    
It's a Microsoft marketing gimmick. The original Windows ASLR implementation had some shortcomings. The latest version of Windows contains improvements to try to address some of those problems and make ASLR even stronger. But at the end of the day, it's still just ASLR, just done a bit better. –  D.W. Nov 5 '12 at 19:55

1 Answer 1

up vote 8 down vote accepted

HiASLR is a term that represents the improved ASLR in Windows 8. The "hi" part refers to the improvement in entropy generated by the increased number of random bits that the stack and heap can be offset by. Microsoft also included randomisation to various system heaps, system tables, etc. to make the possibility of using a NOP sled or information leak more difficult.

The following table is taken from Ken Johnson and Matt Miller's "Exploit Mitigation Improvements in Win8" talk at BlackHat USA 2012.

Entropy (in bits)      |    Windows 7    |           Windows 8         |
per region             | 32-bit | 64-bit | 32-bit | 64-bit | 64-bit HE |
-----------------------|--------+--------|--------+--------|-----------|
Bottom-up allocations* | 0      | 0      | 8      | 8      | 24        |
    Stacks             | 14     | 14     | 17     | 17     | 33        |
    Heaps              | 5      | 5      | 8      | 8      | 24        |
Top-down allocations*  | 0      | 0      | 8      | 17     | 17        |
    PEBs / TEBs        | 4      | 4      | 8      | 17     | 17        |
EXE images             | 8      | 8      | 8      | 17**   | 17**      |
DLL images             | 8      | 8      | 8      | 19**   | 19**      |
Non-ASLR DLL images*   | 0      | 0      | 8      | 8      | 24        |

* opt-in, either via flag in module or system option
** 64-bit DLLs based below 4GB get 14 bits, EXEs below 4GB get 8 bits.

Note that the final column represents High Entropy, which is the official name for HiASLR.

share|improve this answer
1  
Why was it ever "low entropy"? Who thought that was a good idea? –  Rook Nov 5 '12 at 16:57
    
@Rook There were limitations in the implementation to maintain backward compatibility with old memory management operations used by various drivers. Also, the HE method has a side-effect of forcing ASLR on for all modules in all processes, which can crash old legacy apps. –  Polynomial Nov 5 '12 at 21:14
2  
@kiran The randomisation requires a negligible amount of extra physical memory to store the offsets, as part of the kernel structures that represent processes, modules, threads, heaps, etc. In the big picture, it's a minuscule amount of memory. Remember that ASLR randomises the virtual memory space of processes, and virtual memory pages are mapped, so two pages at 0102b000 and 8f000000 in the same process might be mapped to 7fffffff:0e000000 and 7fffffff:0e001000 in physical memory - no extra memory is needed. –  Polynomial Nov 6 '12 at 11:53
1  
@kiran The complexity comes in when randomising heap allocations, since the virtual memory space may become fragmented if lots of small allocations and deallocations are made. In reference to the legacy problem, some badly written non-ASLR-aware applications assume that two heap allocations made in sequence are given predictable contiguous virtual addresses (which was common on Windows XP), and crash when ASLR is force-enabled. –  Polynomial Nov 6 '12 at 11:57
1  
@kiran There are some memory overheads in kernel ASLR, but HiASLR is about user-mode ASLR. Kernel ASLR doesn't deal with virtual addresses, so any randomisation has to either map an allocation to a random physical address (potentially causing physical memory fragmentation problems) or allocate more memory and offset the "real" allocation at a random position in that memory block. The latter is common in stack randomisation. There are tricks to make kernel heap randomisation more manageable (e.g. size-category allocation pools) but these are beyond the scope of this question. –  Polynomial Nov 6 '12 at 12:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.