Address Space Layout Randomization (ASLR)
- •
What it is
- •
ASLR randomizes memory-region addresses between executions. PIE allows the main executable's base to move too; offsets between locations in the same loaded image remain fixed.
- •
- •
How it works
- •
At load time, the kernel picks a random offset for each memory region and applies it consistently to that region's base address. Relative layout within a region stays fixed — only the base moves.
- •
With a 0x1000-aligned base, its low 12 bits are zero. An address within that image retains the low 12 bits of its fixed offset.
- •
Run 1: stack base = 0x7ffc1a2b3000 binary base = 0x55b2103c0000 Run 2: stack base = 0x7ffe9f294000 binary base = 0x55e4a1c50000 ^^^ changes ^^^^^^^^^^ changes 000 <- low 12 bits always 0 (page align)
- •
- •
When to use it
- •
PIE permits randomization of the main executable. Runtime ASLR settings determine whether it occurs; stack and library mappings are separate.
- •
No usable leak and a full target address is needed -> ASLR blocks a direct hardcoded-address approach; look for either a leak primitive (see Memory Disclosure (Info Leak) ) or a partial-overwrite opportunity that only needs the fixed low bits to matter.
- •
Target service forks per connection -> the child inherits the parent's already-randomized layout, so repeated connections to the same running parent see a constant layout, opening the door to brute force across many connection attempts.
- •
- •
- •
pwntools
- •
base = leaked_address - symbol_offset target = base + target_offset
- •
- •
Debugging
- •
set disable-randomization off # Enable ASLR for subsequent runs. run vmmap
- •
- •
Variants
- •
Partial overwrite: preserve the high address bytes and change only the low bytes needed to reach the target.
- •
For a two-byte overwrite, verify
old_address >> 16 == target_address >> 16. Being in one small image alone is not a guarantee. - •
Pointer arithmetic: a leak plus a verified structural offset can reveal another address in the same mapping. Validate stack relationships for the specific build.
- •
- •
- •
Cards
- •
Why does page alignment matter for defeating ASLR with a partial overwrite?
- •
Page-aligned bases always have zeroed low bits, so overwriting only the low byte(s) of an address can redirect within/near the correct region without needing to know the randomized high bits.
- •
- •
Why does forking weaken ASLR's practical protection?
- •
A forked child inherits the parent's already-randomized layout unchanged, so repeated connections to the same long-lived parent see a constant address space — enabling brute-force attacks that wouldn't work against a freshly-randomized process each time.
- •
- •