Here is some code:
#include <stdio.h>
#include <string.h>
char globalbuf[256];
void function(char *argv) {
char localbuf[256];
strcpy(localbuf, argv);
strcpy(globalbuf, localbuf);
printf("localbuf addr: %p globalbuf addr: %p\n", localbuf, globalbuf);
}
int main(int argc, char **argv) {
function(argv[1]);
return 0;
}
I was examining ASLR and how it works. Some more information about OS and compiler
gcc (Ubuntu/Linaro 4.7.2-2ubuntu1) 4.7.2
Linux 3.5.0-32-generic #53-Ubuntu SMP x86_64 x86_64 x86_64 GNU/Linux
So when I execute this code, I see a constantly changing localbuf address. Which is perfectly fine as I know ASLR is enabled and set to Full Randomized mode. But the globalbuf address always remains the same. I know that uninitialized global and static variables are part of BSS section; and therefore I assume that BSS, Text and Data sections are not being randomized by ASLR.
Is this correct? If not I link towards a paper. Page 2, last paragraph refers to what I am suggesting here.
As I understand, that every process has its own stack, heap, text, bss and data sections/areas, so everytime a process is spawned, a random address is allocated to the base pointer and everything else is just an offset from it. If thats the case, what is being printed for globalbuf, Is it the offset?. How can I find the actual address of globalbuf?