There are many functions running on the system and also they require the ESP register (x86). So if its value becomes constant(by turning off the ASLR), then how could it be possible for every function to have same ESP value?
Because the operating system is initializing
The way the ASLR (Address-Space Layout Randomization) works for stack randomization is very simple. At program start, the operating system, when initializing the
When you disable the ASLR, this addition is skipped and start always at the same value.
For example, in Linux (
As you see, the stack-pointer (
All other OSes behave approximately the same (up to my knowledge).
Turning ASLR on/off affects the initial value of the stack pointer. Whenever a function is called, it reserves the amount of stack it needs, by subtracting from the stack pointer. When this function calls another one, it will push its arguments on the stack (which decreases the stack pointer even more), then call the other function.
If you run the same program several times, with aslr turned off, and with exactly the same input, thus guaranteeing the same program flow, your function will get the same stack pointer every time. But it's not the initial stack pointer; it's the initial stack pointer minus all stack frames previous functions needed.
If you run the same program several times, with aslr turned on, and with exactly the same input, thus guaranteeing the same program flow, your function will get a different stack pointer every time. However, the difference between the initial stack pointer (when main() is called), and the one your function gets, will be the same.
Of course, this assumes the stack is growing downward, which is the case on x86/x64 and most other current processors, but there are architectures where the stack grows up. On those architectures, replace "subtract" with "add".
My crystal ball just told me that with "There are many functions running on the system and also they requires esp" you wanted to say "There are many processes running on a system at the same time, each of them needs a stack; how can they coexist if ASLR is turned off and they have the same stack pointer? Won't they overwrite each other's stacks?"
This is what Virtual Memory is about. There are many resources on the internet that explain virtual memory better than i could in a few lines; so just this: the same virtual addresses are mapped to different physical addresses for different processes.
However, this doesn't have much to do with reverse engineering anymore.
Well, it will not be fixed for every function even if you turn off ASLR, simple example is when function A call function B