Remote Debugging Linux Binaries - Stack Address Changes?

Question

Do stack addresses change every time we remotely debug a Linux binary using linux_server and IDA Pro?

I am using IDA Pro and remote debug a linux binary which is running on a Linux machine and I am using linux_server as the dbgsrv.

I noticed that when I enter a subroutine, the stack address is different every time. Is it expected? Is it because I am debugging remotely?

Answer 1

On modern Linux machines ASLR is enabled by default. As a result, when the process image for the binary is created in virtual memory, the base address of the stack is located at a random offset:

/*
 * These are the functions used to load ELF style executables and shared
 * libraries.  There is no binary dependent code anywhere else.
 */

#ifndef STACK_RND_MASK
#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12)) /* 8MB of VA */
#endif

static unsigned long randomize_stack_top(unsigned long stack_top)
{
    unsigned long random_variable = 0;

    if (current->flags & PF_RANDOMIZE) {
        random_variable = get_random_long();
        random_variable &= STACK_RND_MASK;
        random_variable <<= PAGE_SHIFT;
    }
#ifdef CONFIG_STACK_GROWSUP
    return PAGE_ALIGN(stack_top) + random_variable;
#else
    return PAGE_ALIGN(stack_top) - random_variable;
#endif
}

We can test this with a simple program that prints the memory address of a local variable in function main():

#include <stdio.h>

int main(void){

        int i = 3;

        printf("%p\n", &i);

        return 0;
}

compile and execute:

$ gcc -m32 -o print_stack_address print_stack_address.c 
$ ./print_stack_address 
0xff9dc78c
$ ./print_stack_address 
0xff832d3c
$ ./print_stack_address 
0xff844c1c
$ ./print_stack_address 
0xff999e0c
$ ./print_stack_address 
0xffd1117c

Answer 2

Most modern operating systems never guaranteed the stack's location will be the same for different process creations to begin with, and this was mostly a byproduct of deterministic execution of those allocations during the operating system's process creation flow.

Moreover, that fact was then used quite frequently to use constant values for stack addresses during exploitation, which is what ASLR prevents. for a while now stacks are being ASLRed to mitigate exploitation, and are actually guaranteed to be randomized.