Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon. Entire thread

Address Space Layout Randomization Considered Harmful

Name: Anonymous 2019-08-20 10:39

Name: Anonymous 2019-08-20 10:56

wow nikita your're really are a bydlo brainlet. you should stop talking about things you know nothing about.

One reason for the slowdown is that modern operating systems enforce the so called ASLR
ASLR on Linux has 0.01% impact on performance. after all, it is fairly simple: just calculate jump address instead of hardcoding it (wow, addition, such slowness) http://pages.cs.wisc.edu/~riccardo/736finalpaper.pdf

to mitigate superficial security flaws that could be inside software
it mitigates pretty serious flaws - it makes it more difficult to use ROP/ret2libc techniques when exploiting buffer overflows (and this is what was used for exploiting them after they added non-executable stack to prevent hackers from just putting shellcode on stack and jumping there). in many cases, it makes them unexploitable without an additional infoleak vuln.

There is no way to opt-out from ASLR today
that is simply not true. first of all, ASLR cannot work on non-positionally independent code - so just compiling it while forcing PIC/PIE flags to false is enough to make your're are executable non-ASLR. second of all, you can globally turn off ASLR, at least on Linux:
echo 0 > /proc/sys/kernel/randomize_va_space
all programs started after that won't have ASLR

Additionally, compiler loses the way to use profiler statistics for optimizations, since profiler address space will now be different from the runtime one.
this just isn't true. if you have debug symbols, you can just find the data you need by reading relocation table, all the debuggers know how to do it.

It is also funny how developers silently accept all these training wheels attached to their otherwise lightning fast mountain bike. "Those who sacrifice liberty for security deserve neither."
the same could be said about using a garbage-collected language like Lisp. are you turning into C*dder?

Newer Posts
Don't change these.
Name: Email:
Entire Thread Thread List