The ASLR for IOS app

Source: Internet
Author: User

These two days reverse a program, found every time image List-o-F, its base address is 0x00000, that is, the offset address is 0. Think of this should be loaded in memory when there is no enable offset about, and then found the following answer: ASLR

Baidu Encyclopedia definition of ASLR:

ASLR is a buffer overflow security technology, through the heap, stack, shared library mapping and other linear area layout of the randomization, by increasing the difficulty of the attacker to predict the destination address, to prevent the attacker to directly locate the location of the attack code, to prevent overflow attack the purpose of a technology. Baidu Encyclopedia said more obscure, with white words, is: ASLR (address space layout randomization), that is, the location of the random layout. The ASLR feature is to protect against attacks that have been added to addresses that are loaded at run time, and that is why we use the program's file offset with the random address loaded into memory when we debug the program.

Programs with the ASLR feature have a pie identifier in the Mach-o file header, a binary with the OTOOL-HV command, and a final list of pie identities:

Tong: crack xxxxx$ otool-hv Xxxxxmach header      Magic cputype cpusubtype  caps    filetype Ncmds sizeofcmds      Flags   mh_magic     ARM         V7  0x00     EXECUTE            4272   Noundefs dyldlink twolevel binds_to_weak PIE

I found another binary file without the ASLR mechanism:

Tong: 1401 xxxx$ otool-hv Xxxxmach header      Magic cputype cpusubtype  caps    filetype Ncmds Sizeofcmds      flags   Mh_magic     ARM         V7  0x00     EXECUTE           6036   noundefs dyldlink twolevel Weak_defines Binds_to_weak

There are also some software to remove the pie logo on the internet, but also said that some of the imperfect jailbreak is because of the reason of ASLR, after the jailbreak, each reboot will need to re-jailbreak (the exact words is "jailbreak", may mean now ios9.1 after the jailbreak, each restart, you need to reactivate. )

So, I have a question, if there is no ASLR, does every program need to specify a base address? And not conflict? Otherwise, what if two program base addresses are 0? Also hope the master told

The ASLR for IOS app

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.