Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*"
Favorites infavorites:mine
Status closed:yes
Types is:question
Exclude -[tag]
For more details on advanced search visit our help page
Results tagged with Search options answers only user 655

Address Space Layout Randomisation (ASLR) is a technology used to help prevent shellcode from being successful. It does this by randomly offsetting the location of modules and certain in-memory structures.

ASLR is a hide-and-seek game: in case the attacker succeeds in overflowing a buffer and overwriting pointers, the OS loads the application code (the main executable and its DLL) in randomized … , and a page is 4 kB on x86. This gives, at most, 20 bits of entropy in the randomization of ASLR, but in practice lower than that because spreading the DLL throughout the whole address space can …
answered Dec 2 '12 by Thomas Pornin
ASLR never prevents any buffer overflow. A buffer overflow is when the application writes more bytes in a buffer than can possibly fit; putting the buffer at any random address cannot fix that. What … ASLR changes is the consequences of the overflow. A buffer overflow is exploited by an attacker by trying to making the extra bytes spill over some other elements in a controlled way. ASLR makes that …
answered May 25 '14 by Thomas Pornin
W^X and "Once-writable, never executable" are both sub-cases of DEP. DEP is about making read accesses, and execution accesses, distinct (a writable page is also a readable page). W^X is about using D …
answered Aug 20 '12 by Thomas Pornin
There is some good information here. Apparently, a DLL can be subject to ASLR only if it is tagged as such, because of "backward compatibility issues". Although a DLL is, by nature, meant to be … could not ignore (backward compatibility is very important in the Windows world). So DLL will allow ASLR to happen if the static linker said so, when the DLL was last built. This is a matter of using …
answered Sep 11 '13 by Thomas Pornin
, and also on ASLR). Instead, the binary code must use the GOT again. The GOT address is dynamically computed into a base register. On 32-bit x86, the base register is conventionally %ebx and the …
answered Sep 3 '13 by Thomas Pornin
activity). Linux also features VDSO, which can be thought of as a DLL provided by the kernel, instead of being mapped from a file. The kernel's support for ASLR will randomize the VDSO address on a … ). This is especially true for 32-bit Linux variants; on 64-bit architectures, the address space is still sufficiently big (compared to physical RAM size) to avoid problems. Therefore, ASLR may have to …
answered May 24 '14 by Thomas Pornin
patchset also contains some other security-related features, such as ASLR, which is redundant with some functionality of newer official kernels. …
answered Aug 15 '12 by Thomas Pornin
When debugging some C code, especially tracking down after-free-accesses bugs, address space randomization is quite inconvenient, because it makes bugs non deterministic. By turning it off, you can mu …
answered Aug 20 '12 by Thomas Pornin
A buffer overflow (of the "write" kind) gives any advantage to an attacker only if the attacker can arrange for the overflow to spill over other bytes that are used for something else. At any time, th …
answered Feb 25 '16 by Thomas Pornin
). There is no ASLR for system calls; this is not a relevant concept here. ASLR is for DLL. A DLL is a piece of application code which is loaded into the application address space and is accessible to the … application does, how much memory it allocates previously, and so on. DLL loading "naturally" implies non-fixed loading addresses. ASLR is just voluntary moving around of DLL: the dynamic linker chooses …
answered Jan 18 '13 by Thomas Pornin