Messages in this thread | | | From | 慕冬亮 <> | Date | Mon, 21 Sep 2015 22:31:30 +0800 | Subject | Re: why is text address constant with full randomization? |
| |
2015-09-15 17:05 GMT+08:00 yalin wang <yalin.wang2010@gmail.com>: > >> On Sep 15, 2015, at 16:36, 慕冬亮 <mudongliangabcd@gmail.com> wrote: >> >> First, my linux kernel is Linux 114-212-83-136 4.1.0-2-amd64. >> Second, I copy /bin/cat in system to mycat , and see the address space >> layout below. >> >> mdl@114-212-83-136:~$ ./mycat /proc/self/maps >> 00400000-0040c000 r-xp 00000000 08:03 1046776 >> /home/mdl/mycat >> 0060b000-0060c000 r--p 0000b000 08:03 1046776 >> /home/mdl/mycat >> 0060c000-0060d000 rw-p 0000c000 08:03 1046776 >> /home/mdl/mycat >> 01da7000-01dc8000 rw-p 00000000 00:00 0 >> [heap] >> ...... >> >> The starting address of executable image is constant with my aslr >> configuration 2 (full randomization). >> I think text segment should be inconstant to defeat the attack like >> reusing text code! >> Is it related to fixing offset2lib attack? >> Thanks for any help! >> - mudongliang > > your mycat elf is executable elf file, > it is not possible to random the .text section address, > only relocatable elf file can be random, > you should build your elf with gcc -fPIC to make it relocatable . So this means Debian(my computer) system does not compile its system elf file with -fPIC in default. With fixed text address, it's easy to be attacked. Why there are many distributions which not compile their system elf file in PIC? And in the real word, how do servers protect themselves from being attacked in this way? - mudongliang > > Thanks >
| |