3

I wanted to make some basic tests on Linux ASLR, so i wrote the following code :

#include <stdio.h>

void funct(){
    int a= 0;
}

void main(){
    int b=0;
    printf("funct : %p\n", &funct);
    printf("var stack : %p\n", &b);
}

When I run this code, the second pointer (which points to a value on the stack) seems randomized as it changes from one execution to another, but not the first pointer.

I tried compiling with -fPIC gcc option, but it doesn't work either.

Also, I already checked that /proc/sys/kernel/randomize_va_space is equal to 2.

Could someone explain what I'm doing wrong ?

5

The text segment is not typically randomized in ASLR implementations, and this is why Return-Oriented Programming (ROP) chains work. The idea is that the application's own code should be 'safe', so randomizing this memory space would be a waste of resources.

ROP chains are about building a malicious payload using the application's own functionality. A good analogy is that you can take any well meaning sentence, and make it an insult by choosing specific letters or words to make a new meaning.

  • Thank you. I actually knew about ROP, but what I thought was that code injection was prevented by DEP, which was bypassed by ROP, which was countered by ASLR. Actually I don't really see how the assumption that the code is safe could be well founded, as if there is no flaw in the code you don't need protections anyway. Or am I wrong ? – Chocosup Oct 13 '14 at 15:01
  • @Chocosup In most cases you have to overcome both ASLR and NX zones in a ROP chain, which can be done. A reasonably complex application will have small ROP gadgets that can do nasty things when put together, but I can see how this wasn't obvious before attackers develops ROP chains. Chicken or the egg I suppose, maybe in the future the Text segment will be ASLRed. – rook Oct 13 '14 at 16:32
  • And regarding dynamic libraries ? Are their virtual loading addresses randomized ? Because while you would have to look "manually" into assembler dump to find ROP gadgets in the dev's code, if you can access the glibc functions then you may already know where to look for each gadget, right ? Also, I tested this on windows with visual c++, and it seems to randomize all segments. It is hard to believe for me that windows may be ahead of linux in terms of security, but maybe it's just prejudice... – Chocosup Oct 14 '14 at 7:33
  • 3
    I'm not sure this answer is strictly correct, at least not any more. By default a Linux kernel with ASLR support will not relocate .text, but it will do if the executable is compiled as position independent with -fPIE. – Polynomial Aug 30 '17 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.