Do stack addresses change every time we remotely debug a Linux binary using linux_server and IDA Pro?

I am using IDA Pro and remote debug a linux binary which is running on a Linux machine and I am using linux_server as the dbgsrv.

I noticed that when I enter a subroutine, the stack address is different every time. Is it expected? Is it because I am debugging remotely?

2 Answers 2


On modern Linux machines ASLR is enabled by default. As a result, when the process image for the binary is created in virtual memory, the base address of the stack is located at a random offset:

 * These are the functions used to load ELF style executables and shared
 * libraries.  There is no binary dependent code anywhere else.

#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12)) /* 8MB of VA */

static unsigned long randomize_stack_top(unsigned long stack_top)
    unsigned long random_variable = 0;

    if (current->flags & PF_RANDOMIZE) {
        random_variable = get_random_long();
        random_variable &= STACK_RND_MASK;
        random_variable <<= PAGE_SHIFT;
    return PAGE_ALIGN(stack_top) + random_variable;
    return PAGE_ALIGN(stack_top) - random_variable;

We can test this with a simple program that prints the memory address of a local variable in function main():

#include <stdio.h>

int main(void){

        int i = 3;

        printf("%p\n", &i);

        return 0;

compile and execute:

$ gcc -m32 -o print_stack_address print_stack_address.c 
$ ./print_stack_address 
$ ./print_stack_address 
$ ./print_stack_address 
$ ./print_stack_address 
$ ./print_stack_address 
  • Thanks, I resolved this issue by manually disabling ASLR on the machine.
    – Neon Flash
    Commented Oct 25, 2018 at 22:08
  • @NeonFlash you are welcome
    – julian
    Commented Oct 25, 2018 at 22:36

Most modern operating systems never guaranteed the stack's location will be the same for different process creations to begin with, and this was mostly a byproduct of deterministic execution of those allocations during the operating system's process creation flow.

Moreover, that fact was then used quite frequently to use constant values for stack addresses during exploitation, which is what ASLR prevents. for a while now stacks are being ASLRed to mitigate exploitation, and are actually guaranteed to be randomized.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.