2 ms·
Defense works in layers: bounds checking is a programming language technique (although you can typically switch it off in (some) compilers). ASLR is an OS techn
by mafribe 3y ago
Defense works in layers: bounds checking is a programming language technique (although you can typically switch it off in (some) compilers). ASLR is an OS technique, which works even if bonds checks are switched off. IIRC at some point one OS (Debian?) had a bug in the randomness generation for ASLR, and it was easy to circumvent ASLR because of that.
- UncleMeat 3y agoAll you need to defeat ASLR is a data exfil so you can dump the process code. A great paper (https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=05c49820bb35d0b8d7a2168a9124e506a0334b57 https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&d...) from about a decade ago created fully automated ROP against ASLRed processes (though it did rely on the fact that fork() didn't rerandomize on linux at the time).