Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I asked this question before, it was close and voted negative, I definitely feel bad about it. But I would really like to know the answer, so I ll make it more clear this time.

Here is some code:

#include <stdio.h>
#include <string.h>

char globalbuf[256];

void function(char *argv) {
   char localbuf[256];
   strcpy(localbuf, argv);
   strcpy(globalbuf, localbuf);
   printf("localbuf addr: %p globalbuf addr: %p\n", localbuf, globalbuf);
}

int main(int argc, char **argv) {
   function(argv[1]);
   return 0;
}

I was examining ASLR and how it works. Some more information about OS and compiler

gcc (Ubuntu/Linaro 4.7.2-2ubuntu1) 4.7.2
Linux 3.5.0-32-generic #53-Ubuntu SMP x86_64 x86_64 x86_64 GNU/Linux

So when I execute this code, I see a constantly changing localbuf address. Which is perfectly fine as I know ASLR is enables and set to Full Randomized mode. But the globalbuf address always remain the same. I know that uninitialized global and static variables are part of BSS section; and therefore I assume that BSS, Text and Data sections are not being randomized by ASLR.

Is this correct? If not I link towards a paper. Page 2, last paragraph refers to what I am suggesting here.

As I understand, that every process has its own stack, heap, text, bss and data sections/areas, so everytime a process is spawned, a random address is allocated to the base pointer and everything else is just an offset from it. If thats the case, what is being printed for globalbuf, Is it the offset?. How can I find the actual address of globalbuf

Thanks,

share|improve this question
2  
This is a lot better than your previous question. –  Lucas Kauffman Jun 12 '13 at 15:29
3  
In the future, do edit your previous question. If the community finds the edit useful, it will be reopened. –  Terry Chia Jun 12 '13 at 15:31

1 Answer 1

up vote 2 down vote accepted

The globalbuf variable is an uninitialised static variable, so its virtual address is not randomised.

I know that uninitialized global and static variables are part of BSS section; and therefore I assume that BSS, Text and Data sections are not being randomized by ASLR.

The BSS section is not randomised because it is marked as uninitialised data. This is a flag that is set on the section header in the executable file. The data in this section is static, and will always have the same address every time you run the application. The unchanging pointer value you see is the virtual address of the globalbuf variable.

The text and data sections are randomised, because they are marked as code segment (CS) and data segment (DS) respectively. Note that code and data segments have special meaning in x86, and their base addresses are populated into the CS and DS segment registers. This is why you'll often see references like dword ptr ds:[05012340] and dword ptr cs:[00410000] in assembly - the former is an address inside the data segment (DS), and the latter is an address inside the code segment (CS). Since these are important sections, their base addresses are randomised (i.e. equally offset from a base address).

share|improve this answer
    
Thanks for the reply. So I can say, that it is by design that BSS section is not randomized by ASLR and therefore it is vulnerable to ASLR bypassing techniques? –  fahad Jun 12 '13 at 17:52
    
Yes and no. BSS isn't randomised by design, but as long as DEP is enabled (which is a prerequisite of ASLR being effective) then BSS is no threat - it's non-executable memory, and doesn't contain anything that can be particularly useful for a ROP chain. –  Polynomial Jun 13 '13 at 8:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.