Address Space Layout Randomization (ASLR) Dirk Gordon

Implementation (32 bit) Windows Vista Linux 2.6.12 8 (28 = 256) bits of randomization Linux 2.6.12 16 (216 = 65536) bits of randomization

Process Memory ASLR_DEMO memory layout Buffer 4 bytes EBP 4 bytes Return Address 4 bytes

Process Memory ASLR_DEMO memory layout Buffer AAAA 4 bytes EBP 4 bytes Return Address \x00\x00\x00\x00 4 bytes

Process Memory ASLR_DEMO memory layout Buffer AAAA 4 bytes EBP 4 bytes Points to System() System() Address 4 bytes System() Return Address Points to Exit() 4 bytes Binary to execute System() Parameter 4 bytes