Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Essentially my question is, why ASLR doesn't randomize text, bss and data regions of the process? Also in the newer version of kernels (such as Linux kernel version 3.x) along with process base, libraries and stack addresses, are the heap addresses also randomized?

share|improve this question
    
Really, I don't really know why its not clear enough. But okay Majority thinks, it ambigous. –  fahad Jun 12 '13 at 14:10
add comment

closed as not a real question by Adnan, NULLZ, Terry Chia, TildalWave, Scott Pack Jun 12 '13 at 12:41

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

why ASLR doesn't randomize text, bss and data regions of the process?

It does. The base address of the module is randomised, and therefore the virtual address of all sections will be randomised. However, the relative virtual address of sections from base must remain static, as most memory-access instructions work by relative offsets. Otherwise you'd need to generate fixups for every mov that crosses section boundaries (e.g. an instruction in .text that reads from .data).

It just wouldn't bring any real benefit, would cause lots of problems, and could be easily bypassed by reading known instructions in the current section (fixups are applied in memory).

Also in the newer version of kernels (such as Linux kernel version 3.x) along with process base, libraries and stack addresses, are the heap addresses also randomized?

Yes. Each heap's virtual base address is random, and heap allocations are performed within that heap as normal.

share|improve this answer
    
Since the question is closed, so I cannot add any code snippet to explain what I mean. I have C code which has a global variable. So everytime when I execute the code, the base pointer changes as expected because of ASLR. But using gdb when I look at address of global variable, it always stays the same. As I know that uninitialized global and static variables are placed at BSS section, I assume the addresses to these parts are not randomized. Plus referring to a paper here: users.ece.cmu.edu/~dbrumley/courses/18732-f11/docs/aslr.pdf Page 2, last para, says the same –  fahad Jun 12 '13 at 14:15
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.