Understand ASLR and Information Leaks

Topic Overview

Address Space Layout Randomization

ASLR randomizes the memory addresses used by process components: stack, heap, libraries, and (with PIE) the executable base. This makes it difficult for attackers to predict where to jump during an exploit.

Measuring and Bypassing ASLR

Run the same program multiple times and observe that stack and libc addresses change each run. On 32-bit systems, entropy may be as low as 16 bits (~65536 positions), making brute force viable. On 64-bit, entropy is much higher.

Bypass techniques:

1. Brute force: retry the exploit until the address guess is correct
2. Information leak: use a format string bug or buffer over-read to reveal an address
3. Partial overwrite: change only the low bytes of a return address

For example, leaking a libc address like 0x7f3a2b4c1000 lets you calculate system() at leaked_addr + known_offset.

For This Exercise

You will perform the leak arithmetic itself: given a leaked libc address and the offsets of two symbols in that libc, compute the libc base and the address of the second symbol: the exact calculation that turns one leaked address into arbitrary libc code execution. You will also validate the result: a real libc base is always page-aligned, so a non-aligned result means your offsets or leak are wrong.

Calculating Addresses from Leaks

Once you leak printf at 0x7f1234567890, subtract the known offset from your libc version to get the libc base. Add the offset of system() to get its runtime address. The same technique works for stack addresses: leak a stack variable, calculate the distance to your shellcode or ROP chain. PIE requires leaking an address inside the executable to defeat code randomization too.

Write a C program that reads three hexadecimal values from stdin (a leaked libc function address, that symbol's offset within libc, and the offset of a second symbol) and reconstructs the libc base and the second symbol's runtime address.

Requirements:

• Compute libc base = leaked address - symbol offset, using 64-bit unsigned arithmetic
• Compute the second symbol's runtime address = libc base + its offset
• Validate the result: a real libc base is page-aligned (low 12 bits zero); a non-aligned result means the leak or offsets are wrong
• Print all values as full 16-digit hex addresses

Success Criteria:

• Subtraction and addition are done in 64-bit unsigned arithmetic (addresses exceed 32 bits)
• The page-alignment sanity check distinguishes plausible from implausible leaks
• Output shows the leaked address, both symbol offsets, the base, and the computed address