I would like that a shared library is always loaded at the same address on Android 4.0.3.
I can't seem to disable the ASLR using:
echo 0 > /proc/sys/kernel/randomize_va_space
Running
cat /proc/sys/kernel/randomize_va_space
indeed shows 0, but after starting the application the shared library is always (still) loaded at a different address.
EDIT:
Above behavior is seen when starting an activity that loads a shared object using command
am start -n <activity>
OTOH, when trying with a small native process written in C, the same shared library gets loaded to the same addresses when ASLR is disabled either with
echo 0 > /proc/sys/kernel/randomize_va_space
or
sysctl -w kernel.randomize_va_space=0
I've compiled the application using android-ndk-r7c toolchain arm-linux-androideabi-4.4.3 without any special compiler switches (e.g. -fPIE or -pie).
I've also tried something like described here, but the shared library still gets loaded at different addresses - I guess that per-process ASLR can not be disabled on Android.
I have not managed to cross-compile the setarch.c from util-linux due to missing SYS_personality.
EDIT2:
Further investigation resulted in a partial success. This is what I've done and the result is that the application started via "am start -n " loads shared library on mostly two different addresses:
- set the ASLR to disabled state using one of the methods,
- kill the "/system/bin/servicemanager" process (kill -9 PID) - this should bring down the zygote and complete UI, too,
- wait for the servicemanager, zygote and UI to restart - init.rc handles this,
- try to start/kill/start my application
After 20 + start & kill sequences my application always loads shared library on one or another memory address. How come? Have no idea!
Nevertheless this should help debugging the shared library greatly since the shared library is usually loaded on one address several time in a row and then on another address next couple of times and bask to first address..
sysctl -w kernel.randomize_va_space=0
?cat /proc/sys/kernel/randomize_va_space shows
andsysctl kernel.randomize_va_space
show value 0, but the shared library is still loaded at different address.