ASLR was in 10.5 and 10.6 but it's not a good implementation at all (in particular the dynamic linker isn't randomized, and has plenty of useful code in it to p

ASLR was in 10.5 and 10.6 but it's not a good implementation at all (in particular the dynamic linker isn't randomized, and has plenty of useful code in it to play with, rendering the randomization basically pointless). Most ASLR bypasses are when someone's found an application that includes one or more images that was compiled without randomization support and thus has a predictable load address and code to use; with OS X you get one for free in every application by default. 10.7 is supposed to have better ASLR, haven't investigated yet though.