3

Why do IDA and Ollydbg always open some programs with the main() function at the same address?

The address given by IDA is equal to that given by Ollydbg in runtime. However, when I wrote my own C app and ran it, the address of main() was always different between each runtime in Ollydbg.

In IDA, though, there was always the same address, never equal to the one given by Ollydbg, which looked like just some relative address.

Is this caused by the compiler or by something else?

  • Readup on ASLR. – Stolas Oct 27 '13 at 10:54
  • 1
    ASLR = Address-Space Layout Randomization – perror Oct 27 '13 at 11:09
4

From http://en.wikipedia.org/wiki/Address_space_layout_randomization -

Address space layout randomization (ASLR) is a computer security technique involved in protection from buffer overflow attacks. In order to prevent an attacker from reliably jumping to a particular exploited function in memory (for example), ASLR involves randomly arranging the positions of key data areas of a program, including the base of the executable and the positions of the stack, heap, and libraries, in a process's address space.

You can disable ASLR in your C app at build-time by using the linker option /DYNAMICBASE:NO.

  • 3
    You can also remove the flag from an existing EXE by using EDITBIN, or about any hex editor. – Igor Skochinsky Oct 27 '13 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.