Re: Beating memory address randomization (secuirty) features in Unix/Linux

I believe they're talking about distros WITH RANDOMIZATION IE PAX enabled.

On Fri, 31 Mar 2006 15:01:08 -0700
Don Bailey <[email protected]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> > think deeper , all the distros with randomization I have seen ; also 
> > have null byte in ret to libc addresses , so that wont work here .
> >
> 
> Erm, what "distros" are you talking about? I run the latest
> Gentoo on sparc64, pa-risc and ppc and none of them
> have a nil byte in libc addresses. Besides, that doesn't
> always matter.
> 
> Think deeper, you're not always working with strings.
> 
> Below are some pastes of functionality on different
> architectures. Notice the only one that actually shows
> nil bytes is sparc64, but you wont have to worry about
> that because you're not going to jump to the first 255
> bytes.
> 
> Don "north" Bailey
> 
> Here's SuSE on x86
> 
> givingtree.north % ./showstack
> &buffer[0]=bf9947b7
> givingtree.north % ./showstack
> &buffer[0]=bff50067
> givingtree.north % ldd ./showstack
>          linux-gate.so.1 =>  (0xffffe000)
>          libc.so.6 => /lib/tls/libc.so.6 (0xb7e39000)
>          /lib/ld-linux.so.2 (0xb7f59000)
> givingtree.north % uname -mr
> 2.6.16-rc6-givingtree i686
> givingtree.north %
> 
> 
> Here's Gentoo on PA-RISC
> 
> visualize.north % ./showstack
> &buffer[0]=faf2c5c8
> visualize.north % ./showstack
> &buffer[0]=fb16a5c8
> visualize.north % ldd showstack
>          libc.so.6 => /lib/libc.so.6 (0x406ad000)
>          /lib/ld.so.1 => /lib/ld.so.1 (0x4037d000)
> visualize.north % uname -mr
> 2.6.16-rc5-visualize parisc
> visualize.north %
> 
> 
> Here's Gentoo on sparcv9
> 
> blueberry.snow % ./showstack
> &buffer[0]=ef80d997
> blueberry.snow % ./showstack
> &buffer[0]=efeed997
> blueberry.snow % ldd showstack
>          libc.so.6 => /lib/libc.so.6 (0x70030000)
>          /lib/ld-linux.so.2 (0x70000000)
> blueberry.snow % uname -mr
> 2.6.16.1-blueberry sparc64
> blueberry.snow %
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Desktop 9.0.5 (Build 5050)
> 
> iQA/AwUBRC2mpV/Ie1ANMtLuEQKRCgCg0xBuYb2UX66el7eKeA3LDNhsXGoAn32k
> HVnpOIYhjgAzCzoDeSd7V5G/
> =o9Xn
> -----END PGP SIGNATURE-----
> 


-- 
[ sean ]
[ pgp key id: 0x421C8CD9 ]
[ The advantage of a bad memory is that one enjoys several ]
[ times the same good things for the first time. ]