Linux has multiple x86 ABIs: ia32, x32 and x86_64.

ia32 and x32 both use 32 bit addresses for addressing and x86_64 uses 64 bit.

Now, the question: Since the size of the memory space should affect how much addresses could be randomized, how much does this impact the effectiveness of ASLR, and how much does it matter in practice? Similarly, does the number of available registers somehow matter for ASLR effectiveness?

  • Feel free to add an "abi" tag if appropriate. I tried, but I don't have the enough reputation. – Simon Lindgren Jan 13 '14 at 21:49

May be this will give you more information :


Address space layout randomization


Address space layout randomization is based upon the low chance of an attacker guessing the locations of randomly placed areas. Security is increased by increasing the search space. Thus, address space randomization is more effective when more entropy is present in the random offsets. Entropy is increased by either raising the amount of virtual memory area space over which the randomization occurs or reducing the period over which the randomization occurs. The period is typically implemented as small as possible, so most systems must increase VMA space randomization.

To defeat the randomization, attackers must successfully guess the positions of all areas they wish to attack. For data areas such as stack and heap, where custom code or useful data can be loaded, more than one state can be attacked by using NOP slides for code or repeated copies of data. This allows an attack to succeed if the area is randomized to one of a handful of values. In contrast, code areas such as library base and main executable need to be discovered exactly. Often these areas are mixed, for example stack frames are injected onto the stack and a library is returned into.

ASLR makes the job of exploitation much more difficult but not impossible. I don't think the number of register increases the effectiveness of ASLR. If you practice vulnerability exploitation you will see that jumping/finding to the right address in memory to your shellcode is very difficult with ASLR even with NOPs. If the stack is not executable (DEP) its even more difficult and return to libc technique is used.

Another similar topic

Additional information also here

  • I was hoping for a more in-depth discussion, but I guess I get what I deserve for not writing that :) Anyway, I don't have enough rep to upvote and you deserve some for the question so I'll accept it. – Simon Lindgren Jan 16 '14 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.