I was trying out a ROP exploit -- I'm trying to make an mprotect system call using ROP(not a libc call), to try and make the buffer executable. I tried stracing the server process and ran the exploit, only to see that results in an error as follows :-
mprotect(0xbffdda10, 65536, PROT_READ|PROT_WRITE|PROT_EXEC) = -1 EINVAL(Invalid argument)
Later on, I tried a different address
0x08048000 and I could see that the call worked(strace output and /proc/pid/maps confirms this).
Given a buffer address how could I guess/find the correct page address that I could use to make a call to mprotect.
I think I figured out the reason why this happens. ASLR is enabled and the page that starts at 0x08048000 does not change addresses. However, the page that corresponds to the buffer changes addresses. The buffer address can be leaked -- so I tried checking if the difference between the start of the page and the buffer address remains constant, it does not.