原文地址:http://blog.sina.com.cn/s/blog_702eef6501011v07.html
(1)有一个内核参数randomize_va_space用于控制系统级ASLR:
--------------------------------------------------------------------------
0
关闭ASLR
1
mmap base、stack、vdso page将随机化。这意味着.so文件将被加载到随机地址。链接时指定了-pie选项的可执行程序,其代码段加载地址将被随机化。配置内核时如果指定了CONFIG_COMPAT_BRK,randomize_va_space缺省为1。此时heap没有随机化。
2
在1的基础上增加了heap随机化。配置内核时如果禁用CONFIG_COMPAT_BRK,randomize_va_space缺省为2。
--------------------------------------------------------------------------
查询randomize_va_space当前设置:
# sysctl -n kernel.randomize_va_space
1
# cat /proc/sys/kernel/randomize_va_space
1
关闭ASLR:
# sysctl -w kernel.randomize_va_space=0
# echo 0 > /proc/sys/kernel/randomize_va_space
(2)可以用ldd快速判断当前系统是否启用了ASLR:
$ ldd `which col` linux-gate.so.1 => (0xffffe000) libc.so.6 => /lib/i686/cmov/libc.so.6 (0xb7ded000) /lib/ld-linux.so.2 (0x80000000) $ ldd `which col` linux-gate.so.1 => (0xffffe000) libc.so.6 => /lib/i686/cmov/libc.so.6 (0xb7db5000) /lib/ld-linux.so.2 (0x80000000) $ ldd `which col` linux-gate.so.1 => (0xffffe000) libc.so.6 => /lib/i686/cmov/libc.so.6 (0xb7db0000) /lib/ld-linux.so.2 (0x80000000) 注意,本例中有两个so的加载基址未被随机化。 $ cat /proc/self/maps > 1.txt $ cat /proc/self/maps > 2.txt $ diff 1.txt 2.txt 4,15c4,15 < b7bb1000-b7db1000 r--p 00000000 08:01 98130 /usr/lib/locale/locale-archive < b7db1000-b7db2000 rw-p b7db1000 00:00 0 < b7db2000-b7ef2000 r-xp 00000000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so < b7ef2000-b7ef4000 r--p 0013f000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so < b7ef4000-b7ef5000 rw-p 00141000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so < b7ef5000-b7ef8000 rw-p b7ef5000 00:00 0 < b7f09000-b7f0b000 rw-p b7f09000 00:00 0 < b7f0b000-b7f0c000 r-xp b7f0b000 00:00 0 [vdso] < b7f0c000-b7f27000 r-xp 00000000 08:01 1046552 /lib/ld-2.11.2.so < b7f27000-b7f28000 r--p 0001a000 08:01 1046552 /lib/ld-2.11.2.so < b7f28000-b7f29000 rw-p 0001b000 08:01 1046552 /lib/ld-2.11.2.so < bfe27000-bfe3d000 rw-p bfe27000 00:00 0 [stack] --- > b7bfa000-b7dfa000 r--p 00000000 08:01 98130 /usr/lib/locale/locale-archive > b7dfa000-b7dfb000 rw-p b7dfa000 00:00 0 > b7dfb000-b7f3b000 r-xp 00000000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so > b7f3b000-b7f3d000 r--p 0013f000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so > b7f3d000-b7f3e000 rw-p 00141000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so > b7f3e000-b7f41000 rw-p b7f3e000 00:00 0 > b7f52000-b7f54000 rw-p b7f52000 00:00 0 > b7f54000-b7f55000 r-xp b7f54000 00:00 0 [vdso] > b7f55000-b7f70000 r-xp 00000000 08:01 1046552 /lib/ld-2.11.2.so > b7f70000-b7f71000 r--p 0001a000 08:01 1046552 /lib/ld-2.11.2.so > b7f71000-b7f72000 rw-p 0001b000 08:01 1046552 /lib/ld-2.11.2.so > bfa6e000-bfa83000 rw-p bfa6e000 00:00 0 [stack] diff输出表明stack、vsdo page、一些so的地址均被随机化。 $ cat 1.txt 08048000-0804f000 r-xp 00000000 08:01 196226 /bin/cat 0804f000-08050000 rw-p 00006000 08:01 196226 /bin/cat 08050000-08071000 rw-p 08050000 00:00 0 [heap] b7bb1000-b7db1000 r--p 00000000 08:01 98130 /usr/lib/locale/locale-archive b7db1000-b7db2000 rw-p b7db1000 00:00 0 b7db2000-b7ef2000 r-xp 00000000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7ef2000-b7ef4000 r--p 0013f000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7ef4000-b7ef5000 rw-p 00141000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7ef5000-b7ef8000 rw-p b7ef5000 00:00 0 b7f09000-b7f0b000 rw-p b7f09000 00:00 0 b7f0b000-b7f0c000 r-xp b7f0b000 00:00 0 [vdso] b7f0c000-b7f27000 r-xp 00000000 08:01 1046552 /lib/ld-2.11.2.so b7f27000-b7f28000 r--p 0001a000 08:01 1046552 /lib/ld-2.11.2.so b7f28000-b7f29000 rw-p 0001b000 08:01 1046552 /lib/ld-2.11.2.so bfe27000-bfe3d000 rw-p bfe27000 00:00 0 [stack] $ cat 2.txt 08048000-0804f000 r-xp 00000000 08:01 196226 /bin/cat 0804f000-08050000 rw-p 00006000 08:01 196226 /bin/cat 08050000-08071000 rw-p 08050000 00:00 0 [heap] b7bfa000-b7dfa000 r--p 00000000 08:01 98130 /usr/lib/locale/locale-archive b7dfa000-b7dfb000 rw-p b7dfa000 00:00 0 b7dfb000-b7f3b000 r-xp 00000000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7f3b000-b7f3d000 r--p 0013f000 08:01 769046 /lib/i686/cmov/libc-2.11.2.so b7f3d000-b7f3e000 rw-p 00141000 08:01 769046