If I have a binary file which does not have ASLR enabled. However, the libc file it uses has ASLR enabled, then will the address of system() in libc file be randomized every time?

Or the address will be the same every time because the binary itself does not have ASLR enabled?

up vote 2 down vote accepted

When the process is created it is the job of the loader to parse the ELF and allocate/map memory segments, resolve and load libraries. The base offset for any shared object is decided by the loader at load time. But this depends on the ASLR setting of the operating system, not the binary.

$ gcc -m32 -no-pie -fno-pic -zexecstack untitled.c -o untitled
$ ldd ./untitled
    linux-gate.so.1 (0xf7f66000)
    libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7d4b000)
    /lib/ld-linux.so.2 (0xf7f68000)
$ ldd ./untitled
    linux-gate.so.1 (0xf7fd1000)
    libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7db6000)
    /lib/ld-linux.so.2 (0xf7fd3000)
$ ldd ./untitled
    linux-gate.so.1 (0xf7f8f000)
    libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7d74000)
    /lib/ld-linux.so.2 (0xf7f91000)

However once system wide ASLR is disabled

$ echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
0
$ ldd `which cat`
    linux-vdso.so.1 (0x00007ffff7ffa000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff7831000)
    /lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd9000)
$ ldd `which cat`
    linux-vdso.so.1 (0x00007ffff7ffa000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff7831000)
    /lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd9000)
$ ldd `which cat`
    linux-vdso.so.1 (0x00007ffff7ffa000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff7831000)
    /lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd9000)

Offset of system with respect to libc base should remain constant in a libc.

  • So are you saying that ASLR for the main binary does not matter? And only OS level ASLR setting matters? – Neon Flash Dec 6 at 4:39
  • How do you disable ASLR for any binary? – sudhackar Dec 6 at 4:42
  • My question is specifically related to address of system() function in libc. Since, libc has PIE enabled, so I understand that if OS has ASLR enabled then it will randomize the addresses in libc? Will the address of system() function be randomized as well? – Neon Flash Dec 6 at 4:47
  • Should I create a new question for finding "system" and "/bin/sh" address from a given libc file? – Neon Flash Dec 6 at 5:06
  • I'll mark this one as resolved. – Neon Flash Dec 6 at 5:06

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.