| 1 |
Thanks for your answer (sorry to respond that late). It actually makes |
| 2 |
sense, I thought there was some *magic* possible. |
| 3 |
This proves once again how fragile security can be (I'm thinking about |
| 4 |
compilated distributions, where kernel can be hardened but the |
| 5 |
compilation process must also be taken care of). |
| 6 |
|
| 7 |
Thanks again |
| 8 |
-- |
| 9 |
François |
| 10 |
|
| 11 |
|
| 12 |
On 27 August 2015 at 19:42, Sven Vermeulen <swift@g.o> wrote: |
| 13 |
> On Thu, Aug 27, 2015 at 03:02:59PM +0200, François wrote: |
| 14 |
>> this is my first message here, I hope I'm not off-topic! |
| 15 |
>> |
| 16 |
>> I've been reading [1], and tried on my gentoo system: |
| 17 |
>> |
| 18 |
>> fser@regal /tmp$ ./aslr-test-without |
| 19 |
>> main @ 0x4005da |
| 20 |
>> doit @ 0x40059b |
| 21 |
>> fser@regal /tmp$ ./aslr-test-without |
| 22 |
>> main @ 0x4005da |
| 23 |
>> doit @ 0x40059b |
| 24 |
>> fser@regal /tmp$ ./aslr-test-without |
| 25 |
>> main @ 0x4005da |
| 26 |
>> doit @ 0x40059b |
| 27 |
>> |
| 28 |
>> |
| 29 |
>> and |
| 30 |
>> |
| 31 |
>> fser@regal /tmp$ ./aslr-test-withpie |
| 32 |
>> main @ 0x468f410820 |
| 33 |
>> doit @ 0x468f4107e1 |
| 34 |
>> fser@regal /tmp$ ./aslr-test-withpie |
| 35 |
>> main @ 0x6d8a0f9820 |
| 36 |
>> doit @ 0x6d8a0f97e1 |
| 37 |
>> fser@regal /tmp$ ./aslr-test-withpie |
| 38 |
>> main @ 0x33eb5d8820 |
| 39 |
>> doit @ 0x33eb5d87e1 |
| 40 |
>> fser@regal /tmp$ ./aslr-test-withpie |
| 41 |
>> main @ 0x769c4a5820 |
| 42 |
>> doit @ 0x769c4a57e1 |
| 43 |
>> |
| 44 |
>> I was under the impression that ASLR was enforced by the kernel, when |
| 45 |
>> creating a new context for a process. |
| 46 |
>> Reading the description of [1], I was expecting the adress of main (at |
| 47 |
>> least) to be different. |
| 48 |
>> |
| 49 |
>> Can someone explain me this behavior? |
| 50 |
> |
| 51 |
> ASLR only works properly with binaries that use Position Independent Code. That |
| 52 |
> means that the generated machine code does not hardcode any (virtual) |
| 53 |
> addresses, instead uses relative addressing. Some information about this is |
| 54 |
> at |
| 55 |
> https://wiki.gentoo.org/wiki/Hardened/Introduction_to_Position_Independent_Code |
| 56 |
> but the page can benefit from some clean-ups and editing. |
| 57 |
> |
| 58 |
> With ASLR, applications are given a random base address. With non-PIC |
| 59 |
> applications, this doesn't matter as the base address is hardly used. The |
| 60 |
> code has hardcoded locations anyway, so the (randomized) base address is |
| 61 |
> ignored. |
| 62 |
> |
| 63 |
> Wkr, |
| 64 |
> Sven Vermeulen |
| 65 |
> |
Archives