Analysis of 32-bit Windows Vista ASLR - https://www.blackhat.com/presentations/bh-dc-07/Whitehouse/Paper/bh-dc-07-Whitehouse-WP.pdf https://www.blackhat.com/pre

Analysis of 32-bit Windows Vista ASLR - https://www.blackhat.com/presentations/bh-dc-07/Whitehouse/Paper/bh-dc-07-Whitehouse-WP.pdf https://www.blackhat.com/presentations/bh-dc-07/Whitehouse/P... After the stack address has been selected, the process heaps are selected. Each heap is allocated from a range of 32 different locations, each separated by 64kB. The location of the first heap must be chosen to avoid the previously placed stack, and each of the following heaps must be allocated to avoid those allocated before it. An important result of Vista’s ASLR design is that some address space layout parameters such as PEB, stack and heap locations are selected once per program execution. Other parameters, such as the location of the program code, data segment, BSS segment and libraries, change only between reboots. This paper shows that the stack, heap, image and PEB protected by ASLR on Microsoft Windows Vista 32bit RTM have different frequency distributions. While the stack has near uniform distribution over a very wide range, the heap and PEB, and to a lesser degree the image base have much smaller ranges and because of biases in their distributions do not efficiently use this range. As a result, the protection offered by ASLR under Windows Vista may not be as robust as expected.