Take the 2-minute tour ×
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.

There are many functions running on the system and also they require the ESP register (x86). So if its value becomes constant(by turning off the ASLR), then how could it be possible for every function to have same ESP value?

share|improve this question
    
Because each process has its own context? This problem would also apply to standard ImageBases for executables without relocations, etc... –  Ange Aug 19 at 15:19

3 Answers 3

Because the operating system is initializing ESP always at the same value (and that the execution of the program you look at are deterministic).

The way the ASLR (Address-Space Layout Randomization) works for stack randomization is very simple. At program start, the operating system, when initializing the ESP register, will add a random value to it.

When you disable the ASLR, this addition is skipped and start always at the same value.

For example, in Linux (arch/x86/kernel/process.c) we have:

unsigned long arch_align_stack(unsigned long sp)
{
    if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
            sp -= get_random_int() % 8192;
    return sp & ~0xf;
}

As you see, the stack-pointer (ESP) is added to a random value to shuffle its original value. And, it will be ignored if one of the conditions in the conditional is not true.

All other OSes behave approximately the same (up to my knowledge).

share|improve this answer

Turning ASLR on/off affects the initial value of the stack pointer. Whenever a function is called, it reserves the amount of stack it needs, by subtracting from the stack pointer. When this function calls another one, it will push its arguments on the stack (which decreases the stack pointer even more), then call the other function.

If you run the same program several times, with aslr turned off, and with exactly the same input, thus guaranteeing the same program flow, your function will get the same stack pointer every time. But it's not the initial stack pointer; it's the initial stack pointer minus all stack frames previous functions needed.

If you run the same program several times, with aslr turned on, and with exactly the same input, thus guaranteeing the same program flow, your function will get a different stack pointer every time. However, the difference between the initial stack pointer (when main() is called), and the one your function gets, will be the same.

Of course, this assumes the stack is growing downward, which is the case on x86/x64 and most other current processors, but there are architectures where the stack grows up. On those architectures, replace "subtract" with "add".

EDIT:

My crystal ball just told me that with "There are many functions running on the system and also they requires esp" you wanted to say "There are many processes running on a system at the same time, each of them needs a stack; how can they coexist if ASLR is turned off and they have the same stack pointer? Won't they overwrite each other's stacks?"

This is what Virtual Memory is about. There are many resources on the internet that explain virtual memory better than i could in a few lines; so just this: the same virtual addresses are mapped to different physical addresses for different processes.

However, this doesn't have much to do with reverse engineering anymore.

share|improve this answer
    
Oh, reading your answer just made it clear that the question was also about process virtual memory... I missed half of the question in my own answer... +1 for you. –  perror Aug 19 at 8:38
    
I'm not even sure the question is about virtual memory - not being a native speaker myself, i have some understanding for posters who are struggling to explain their problem and hit the wrong "keywords", in this case "functions". –  Guntram Blohm Aug 19 at 9:04
    
In fact, I think that the question is coming from the fact the author didn't know about how are the processes kept separated in memory... So, indirectly, I think it is. You managed to read between lines ! :-) –  perror Aug 19 at 9:11

Well, it will not be fixed for every function even if you turn off ASLR, simple example is when function A call function B

A:
...
...
...
call B ---> (1)
[next instruction]
...

(1) This assembly instruction will push the address of [next instruction] to the stack as a return address, which will increase the value of ESP, meaning that ESP value for function B is now different

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.