> modern statically linked binaries use a feature called Address Space Layout Randomization which (ab)uses the implementation of the dynamic loader to randomize

> modern statically linked binaries use a feature called Address Space Layout Randomization which (ab)uses the implementation of the dynamic loader to randomize where the symbols of your "statically" linked binary are going to be once the program is loaded into memory Address randomization isn't a feature of the dynamic loader, but of the kernel's loader. As soon as you specify ET_DYN as the file type, the kernel adds up the fixed sizes of all the segments and the fixed gaps between them, and reserves space for them below the mmap base, which is randomized unless ASLR is disabled in the kernel. This occurs even if the program specifies no interpreter (e.g., if it's a dynamic loader being executed directly). The offsets between the program's symbols are fixed, even as their absolute addresses vary. If the program does specify an interpreter, then the interpreter has to obtain the program's entry point from AT_ENTRY in the auxiliary vector. (Also, even non-position-independent programs of type ET_EXEC are partially subject to ASLR: the loadable segments and program break appear at a fixed address, but the stack's address is always randomized unless ASLR is disabled. Meanwhile, the kernel always attempts to randomize the address of the vDSO, except that if the stack is at the top of the address space, as it usually is without ASLR, the vDSO is placed below the mmap base, which is predictable but depends on the current value of RLIMIT_STACK.)