2

According to Wiki, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap and libraries.

Conceptually, ASLR prevents buffer overflow exploits that rely on knowledge of the process memory address layout. While I understand that the more randomization the better, would it be useful to only randomize the base of the executable, and leave the rest unchanged, relative to this base? If an attacker has trouble getting the base address of the executable, he will have trouble getting the base address of other areas of the executable, right? Or am I missing something?

2

No. Many attacks rely on the address of a library routine, and don't care where the executable is loaded. Pretty much any fixed address can be exploited.

  • Let's say we have an executable that, without ASLR, always starts at memory 0x1000. Library A of that executable always starts at 0x1100. Now, with ASLR implemented only on the base address of the executable, let's say we have a slide of 16 possible locations, i.e. base address could be 0x1000-0x1010, and since the library also slides together with the executable, so it could be 0x1100-0x1110. In this case, wouldn't the attacker need to guess up to 16 library addresses as well? – user1118764 Oct 27 '16 at 3:42
  • There are "find" routines that can be used to locate the desired syscalls. Once they are located, they can be hardcoded accordingly. As John stated, any fixed address (even relatively fixed) can be exploited. – HashHazard Oct 27 '16 at 3:58
  • Depending on the OS, libraries can be loaded at fixed or preferred addresses. If you're talking about statically linked libraries, a relative branch would be unaffected if the distance between the executable and the library was unchanged. – John Deters Oct 27 '16 at 3:58
  • @Hollowproc could you briefly describe, or point me to information on these find routines, and how relatively fixed addresses can be exploited? – user1118764 Oct 27 '16 at 4:07
  • @JohnDeters by unaffected, do you mean they can be exploited as if the base address of the executed wasn't randomized? I guess I'm struggling to understand how it can be exploited. – user1118764 Oct 27 '16 at 4:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.