I'm currently looking into exploit mitigation techniques and I've come across a question I can't find an answer to just now.
To detect the presence of let's says PIE or Canaries within a binary there are scripts, like checksec or simply readelf with the appropriate flags.
These work either during run time or even in a static approach without execution.
To detect ASLR in a running system one can check the contents of /proc/sys/kernel/randomize_va_space.
My questions are:
Is there a way to detect if a firmware/operating system image has kASLR/ASLR enabled without actually running it (static approach).
Is there a doable way to create two firmware images one with these enabled and one without and check the difference in their objdumps outputs?
My Goal is to better understand the Linux kernel internals, as well as get a better grasp about how these security mechanisms are implemented.
Thanks for the help in advance and I hope I'm at the correct place here!