I was debugging some programs with gdb, I already set the disable-randomization to on, but I was having trouble, I set a break point and examined that the $sp is different everytime, what causes this randomization besides ASLR?

  • It's different every time you run it, or is the breakpoint reached multiple times within a single run? I suspect you mean the former. – multithr3at3d Apr 19 '20 at 0:18

ASLR causes the base executable and external libraries (.so, .dll, etc) to load at random base addresses in order to make exploitation harder.

The stack is not part of the loaded image, it is dynamically allocated when the process starts. The changes of stack address is not related to ASLR.

  • Not quite. ASLR definitely does affect loading of stack and heap as well. – multithr3at3d Apr 18 '20 at 23:51
  • When enabled it affects the stack and heap (and other mmap'd areas) as well, but not the other way around. These pages will have some randomization by their nature even when ASLR is disabled. – Yotamz Apr 19 '20 at 8:02
  • sure, but with ASLR disabled, you should be able to run a simple program multiple times and have the stack addresses remain constant. I just confirmed on my system. Look at some simple no-NX buffer overflow challenges; they also depend on the behavior of stack addresses remaining the same between runs. – multithr3at3d Apr 19 '20 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.