Tag Info

Address Space Layout Randomisation (ASLR) is a technology used to help prevent shellcode from being successful. It does this by randomly offsetting the location of modules and certain in-memory structures. Data Execution Prevention (DEP) prevents certain memory sectors, e.g. the stack, from being executed. When combined it becomes exceedingly difficult to ...

To complement @Polynomial's self-answer: DEP can actually be enforced on older x86 machines (which predate the NX bit), but at a price. The easy but limited way to do DEP on old x86 hardware is to use segment registers. With current operating systems on such systems, addresses are 32-bit values in a flat 4 GB address space, but internally each memory access ...

When debugging some C code, especially tracking down after-free-accesses bugs, address space randomization is quite inconvenient, because it makes bugs non deterministic. By turning it off, you can much more easily reproduce the issues. That's a good reason to turn it off on development machines (as opposed to production systems). As for the slowing down, ...

ASLR is a hide-and-seek game: in case the attacker succeeds in overflowing a buffer and overwriting pointers, the OS loads the application code (the main executable and its DLL) in randomized locations, so as to make it harder for the attacker to actually hit a meaningful location. By construction, it works better when the playground is larger. The extended ...

HiASLR is a term that represents the improved ASLR in Windows 8. The "hi" part refers to the improvement in entropy generated by the increased number of random bits that the stack and heap can be offset by. Microsoft also included randomisation to various system heaps, system tables, etc. to make the possibility of using a NOP sled or information leak more ...

You do not call functions inside the kernel. The kernel resides in another privilege level; its memory pages are not accessible from normal code. To jump into kernel code, application code performs a system call which entails using a specific doorway which handles the temporary privilege escalation. On a 32-bit x86 system running Linux, this is done with int ...

W^X and "Once-writable, never executable" are both sub-cases of DEP. DEP is about making read accesses, and execution accesses, distinct (a writable page is also a readable page). W^X is about using DEP to enforce a specific policy, which is that a given page can never be writable and executable at the same time. Compliance to the W^X policy can be required ...

"Leaky Pointers" or more commonly known as "Dangling Pointers" is useful to create an attack chain to bypass a layered security system. The idea behind DEP is that you are making regions of memory non-executable, such that shellcode in this area cannot be executed. DEP alone is really easy to bypass, you can just ret-to-lib, and call any function you ...

how does the program know where to jump to if kernel32.dll function addresses are no longer reliable? Does the loader intervene in this process? The bear has given you the general overview of ASLR. There are a number of points specific to Windows that you need to take away, however: Actually, DLLs have always had to cope with relocation. They contain ...

The globalbuf variable is an uninitialised static variable, so its virtual address is not randomised. I know that uninitialized global and static variables are part of BSS section; and therefore I assume that BSS, Text and Data sections are not being randomized by ASLR. The BSS section is not randomised because it is marked as uninitialised data. This ...

Try "Memory Errors: The Past, the Present, and the Future?" It's an academic paper, but very readable and referencing all of the events and technical details. http://www.isg.rhul.ac.uk/sullivan/pubs/raid-2012.pdf

ASLR involves randomizing the location of objects in memory. For instance, the heap might be moved to a random offset in memory. If you somehow manage to learn the address of an object in the heap, then you've gained a lot of information about the location of the heap in memory. This may be enough to enable you to predict the location of other objects in ...

There's not too much to be gained in actually exploiting it just for a demo. You should be able to demo making your system crash from a phone borrowed from your audience, and that should adequately appall your viewers. If you really want the dogs and ponies to bark and trot, you could rig the demo using rebase on your module. That will let you move the ...