Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
If I have a binary file which does not have ASLR enabled. However, the libc file it uses has ASLR enabled, then will the address of system() in libc file be randomized every time?
Or the address will be the same every time because the binary itself does not have ASLR enabled?
When the process is created it is the job of the loader to parse the ELF and allocate/map memory segments, resolve and load libraries. The base offset for any shared object is decided by the loader at load time. But this depends on the ASLR setting of the operating system, not the binary.
$ gcc -m32 -no-pie -fno-pic -zexecstack untitled.c -o untitled
$ ldd ./untitled
linux-gate.so.1 (0xf7f66000)
libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7d4b000)
/lib/ld-linux.so.2 (0xf7f68000)
$ ldd ./untitled
linux-gate.so.1 (0xf7fd1000)
libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7db6000)
/lib/ld-linux.so.2 (0xf7fd3000)
$ ldd ./untitled
linux-gate.so.1 (0xf7f8f000)
libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7d74000)
/lib/ld-linux.so.2 (0xf7f91000)
However once system wide ASLR is disabled
$ echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
0
$ ldd `which cat`
linux-vdso.so.1 (0x00007ffff7ffa000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff7831000)
/lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd9000)
$ ldd `which cat`
linux-vdso.so.1 (0x00007ffff7ffa000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff7831000)
/lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd9000)
$ ldd `which cat`
linux-vdso.so.1 (0x00007ffff7ffa000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ffff7831000)
/lib64/ld-linux-x86-64.so.2 (0x00007ffff7dd9000)
Offset of system with respect to libc base should remain constant in a libc.
