Address space layout randomization (ASLR)

ASLR is a technique which randomly arranges the libraries, heap, stack and other pages in the memory in random positions. This technique designed for standing against security attacks. If the ASLR is disabled, the memory addresses of libraries and the stack are predefined, so the vulnerable codes(shellcodes) can use these information and directly call library functions. To check if the ASLR is enabled in the system we can run some program twice and compare memory maps.

	$ cat /proc/self/maps > 1
	$ cat /proc/self/maps > 2
	$ diff 1 2
	4,18c4,18
	< 00ebe000-00edf000 rw-p 00000000 00:00 0 [heap]
	< 7f4b0954e000-7f4b097f2000 r--p 00000000 08:01 786578 /usr/lib/locale/locale-archive
	< 7f4b097f2000-7f4b0996c000 r-xp 00000000 08:01 133953 /lib/libc-2.12.1.so
	< 7f4b0996c000-7f4b09b6b000 ---p 0017a000 08:01 133953 /lib/libc-2.12.1.so
	< 7f4b09b6b000-7f4b09b6f000 r--p 00179000 08:01 133953 /lib/libc-2.12.1.so
	< 7f4b09b6f000-7f4b09b70000 rw-p 0017d000 08:01 133953 /lib/libc-2.12.1.so
	< 7f4b09b70000-7f4b09b75000 rw-p 00000000 00:00 0
	< 7f4b09b75000-7f4b09b95000 r-xp 00000000 08:01 133961 /lib/ld-2.12.1.so
	< 7f4b09d76000-7f4b09d79000 rw-p 00000000 00:00 0
	< 7f4b09d93000-7f4b09d95000 rw-p 00000000 00:00 0
	< 7f4b09d95000-7f4b09d96000 r--p 00020000 08:01 133961 /lib/ld-2.12.1.so
	< 7f4b09d96000-7f4b09d97000 rw-p 00021000 08:01 133961 /lib/ld-2.12.1.so
	< 7f4b09d97000-7f4b09d98000 rw-p 00000000 00:00 0
	< 7fffbfc4c000-7fffbfc6d000 rw-p 00000000 00:00 0 [stack]
	< 7fffbfd17000-7fffbfd18000 r-xp 00000000 00:00 0 [vdso]
	---
	> 012cb000-012ec000 rw-p 00000000 00:00 0 [heap]
	> 7f6c9170e000-7f6c919b2000 r--p 00000000 08:01 786578 /usr/lib/locale/locale-archive
	> 7f6c919b2000-7f6c91b2c000 r-xp 00000000 08:01 133953 /lib/libc-2.12.1.so
	> 7f6c91b2c000-7f6c91d2b000 ---p 0017a000 08:01 133953 /lib/libc-2.12.1.so
	> 7f6c91d2b000-7f6c91d2f000 r--p 00179000 08:01 133953 /lib/libc-2.12.1.so
	> 7f6c91d2f000-7f6c91d30000 rw-p 0017d000 08:01 133953 /lib/libc-2.12.1.so
	> 7f6c91d30000-7f6c91d35000 rw-p 00000000 00:00 0
	> 7f6c91d35000-7f6c91d55000 r-xp 00000000 08:01 133961 /lib/ld-2.12.1.so
	> 7f6c91f36000-7f6c91f39000 rw-p 00000000 00:00 0
	> 7f6c91f53000-7f6c91f55000 rw-p 00000000 00:00 0
	> 7f6c91f55000-7f6c91f56000 r--p 00020000 08:01 133961 /lib/ld-2.12.1.so
	> 7f6c91f56000-7f6c91f57000 rw-p 00021000 08:01 133961 /lib/ld-2.12.1.so
	> 7f6c91f57000-7f6c91f58000 rw-p 00000000 00:00 0
	> 7fffd43fb000-7fffd441c000 rw-p 00000000 00:00 0 [stack]
	> 7fffd4501000-7fffd4502000 r-xp 00000000 00:00 0 [vdso]
	$

view raw shell.log hosted with ❤ by GitHub

The memory positions are different, that means the ASLR is enabled. From the debugging point of view it sometimes distrurbs and we need to disable it. There are 2 ways(known to me) to disable ASLR.
1) Disable ASLR using setarch command

	$ # x86_64 is machine's architecture type, \
	$ # a mandatory parameter of setarch command.
	$ setarch x86_64 -R cat /proc/self/maps >1 # -R disables ASLR
	$ setarch x86_64 -R cat /proc/self/maps >2 # -R disables ASLR
	$ diff 1 2 # shows no difference

view raw shell2.log hosted with ❤ by GitHub

2) Disable ASLR for entire system

	$ cat /proc/sys/kernel/randomize_va_space # see status of ASLR
	2
	$ echo 0 | sudo tee /proc/sys/kernel/randomize_va_space # disable ASLR
	0
	$ cat /proc/self/maps >1
	$ cat /proc/self/maps >2
	$ diff 1 2 # shows no difference again

view raw shell3.log hosted with ❤ by GitHub