1

I want to create an executable that keeps the same virtual address during different execution runs.

This is definitely possible because I've seen these files in CTFs(Capture the flag) where the player has to use a buffer overflow, to rewrite the return address in order to execute a "secret" function.

So, is there a way to tell GCC to generate an executable that "doesn't" allow memory randomization on execution?

Or maybe I'm thinking it all wrong. Any info you can share to point me on the right direction will be appreciated.

Improve this question
1
  • 1
    won't disabling ASLR be enough?
    – Paweł Łukasik
    Jan 2, 2020 at 10:50

1 Answer 1

Reset to default
1

As part of ASLR, operating systems use code relocation tables embedded in an executable to change the location where an executable image is located.

If you remove the relocation tables (or generate an executable without it to begin with) the operating system will not be able to relocate the executable image, however other images also loaded to the same process's memory address will still be relocated.

Additionally, an OS may implement/support ASLR related executable file flag to opt-in or out of ASLR and again depending on the OS and user configuration, executables that don't support ASLR may still be randomized.

Visual studio have two related flags, /FIXED and /DYNAMICBASE, for including relocation tables and opting-in for ASLR.

On GCC, -fPIE is used to enable relocation tables (position independent executable).

Improve this answer
2
  • Thanks! this helped. Sometimes not knowing the terms to search for is a stopper. I didn't want to ask the people that will try the code to make their system insecure by disabling ASLR on the whole OS. The answer is using -no-pie on GCC. That will generate an executable without a GOT(Global Offsets Table). Thanks for your help!
    – rderik
    Jan 2, 2020 at 14:40
  • Glad I could help :)
    – NirIzr
    Jan 2, 2020 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.