ASLR Randomization BSS

Question

Here is some code:

#include <stdio.h>
#include <string.h>

char globalbuf[256];

void function(char *argv) {
   char localbuf[256];
   strcpy(localbuf, argv);
   strcpy(globalbuf, localbuf);
   printf("localbuf addr: %p globalbuf addr: %p\n", localbuf, globalbuf);
}

int main(int argc, char **argv) {
   function(argv[1]);
   return 0;
}

I was examining ASLR and how it works. Some more information about OS and compiler

gcc (Ubuntu/Linaro 4.7.2-2ubuntu1) 4.7.2
Linux 3.5.0-32-generic #53-Ubuntu SMP x86_64 x86_64 x86_64 GNU/Linux

So when I execute this code, I see a constantly changing localbuf address. Which is perfectly fine as I know ASLR is enabled and set to Full Randomized mode. But the globalbuf address always remains the same. I know that uninitialized global and static variables are part of BSS section; and therefore I assume that BSS, Text and Data sections are not being randomized by ASLR.

Is this correct? If not I link towards a paper. Page 2, last paragraph refers to what I am suggesting here.

As I understand, that every process has its own stack, heap, text, bss and data sections/areas, so everytime a process is spawned, a random address is allocated to the base pointer and everything else is just an offset from it. If thats the case, what is being printed for globalbuf, Is it the offset?. How can I find the actual address of globalbuf?

Answer 1

The globalbuf variable is an uninitialised static variable, so its virtual address is not randomised.

I know that uninitialized global and static variables are part of BSS section; and therefore I assume that BSS, Text and Data sections are not being randomized by ASLR.

The BSS section is not randomised because it is marked as uninitialised data. This is a flag that is set on the section header in the executable file. The data in this section is static, and will always have the same address every time you run the application. The unchanging pointer value you see is the virtual address of the globalbuf variable.

The text and data sections are randomised (if the application is compiled as position independent with -fPIE), because they are marked as code segment (CS) and data segment (DS) respectively. Note that code and data segments have special meaning in x86, and their base addresses are populated into the CS and DS segment registers. This is why you'll often see references like dword ptr ds:[05012340] and dword ptr cs:[00410000] in assembly - the former is an address inside the data segment (DS), and the latter is an address inside the code segment (CS). Since these are important sections, their base addresses are randomised (i.e. equally offset from a base address).