rzhou

24 ms·

1. 1.▲
   by rzhou 15y ago

   On 32-bit machines, you can disable mmap randomization (and thus library randomization) using ulimit -s unlimited. Also, there's another useful place you can return to that isn't in libc.
2. 2.▲
   by rzhou 15y ago

   On 32-bit systems, it's feasible to brute force, as there are only about 12 bits of entropy. There are a lot more random bits on 64-bit systems, so I don't consider it brute force to be that practical there.
3. 3.▲
   by rzhou 15y ago

   It doesn't stop the exploit, as it is still possible to use ptrace to essentially dump the binary, even though it's not readable.