5

Here is some code:

#include <stdio.h>
#include <string.h>

char globalbuf[256];

void function(char *argv) {
   char localbuf[256];
   strcpy(localbuf, argv);
   strcpy(globalbuf, localbuf);
   printf("localbuf addr: %p globalbuf addr: %p\n", localbuf, globalbuf);
}

int main(int argc, char **argv) {
   function(argv[1]);
   return 0;
}

I was examining ASLR and how it works. Some more information about OS and compiler

gcc (Ubuntu/Linaro 4.7.2-2ubuntu1) 4.7.2
Linux 3.5.0-32-generic #53-Ubuntu SMP x86_64 x86_64 x86_64 GNU/Linux

So when I execute this code, I see a constantly changing localbuf address. Which is perfectly fine as I know ASLR is enabled and set to Full Randomized mode. But the globalbuf address always remains the same. I know that uninitialized global and static variables are part of BSS section; and therefore I assume that BSS, Text and Data sections are not being randomized by ASLR.

Is this correct? If not I link towards a paper. Page 2, last paragraph refers to what I am suggesting here.

As I understand, that every process has its own stack, heap, text, bss and data sections/areas, so everytime a process is spawned, a random address is allocated to the base pointer and everything else is just an offset from it. If thats the case, what is being printed for globalbuf, Is it the offset?. How can I find the actual address of globalbuf?

4

The globalbuf variable is an uninitialised static variable, so its virtual address is not randomised.

I know that uninitialized global and static variables are part of BSS section; and therefore I assume that BSS, Text and Data sections are not being randomized by ASLR.

The BSS section is not randomised because it is marked as uninitialised data. This is a flag that is set on the section header in the executable file. The data in this section is static, and will always have the same address every time you run the application. The unchanging pointer value you see is the virtual address of the globalbuf variable.

The text and data sections are randomised (if the application is compiled as position independent with -fPIE), because they are marked as code segment (CS) and data segment (DS) respectively. Note that code and data segments have special meaning in x86, and their base addresses are populated into the CS and DS segment registers. This is why you'll often see references like dword ptr ds:[05012340] and dword ptr cs:[00410000] in assembly - the former is an address inside the data segment (DS), and the latter is an address inside the code segment (CS). Since these are important sections, their base addresses are randomised (i.e. equally offset from a base address).

  • Thanks for the reply. So I can say, that it is by design that BSS section is not randomized by ASLR and therefore it is vulnerable to ASLR bypassing techniques? – fahad Jun 12 '13 at 17:52
  • 1
    Yes and no. BSS isn't randomised by design, but as long as DEP is enabled (which is a prerequisite of ASLR being effective) then BSS is no threat - it's non-executable memory, and doesn't contain anything that can be particularly useful for a ROP chain. – Polynomial Jun 13 '13 at 8:21
  • 1
    @ultimatecause I think Rook's answer there is not entirely correct; on a machine with ASLR enabled the .text section will not be randomised by default, but will be if the application is compiled as position independent with the -fPIE flag. – Polynomial Aug 30 '17 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.