ASLR: The Weakness — Information Leaks
- ASLR only hides addresses; it does not stop you from reading one that leaks.
- A single leaked pointer reveals a base: subtract the known static offset to derive everything in that region.
- Leak sources: format-string bugs (
%p), uninitialized reads, OOB reads, verbose error messages, side channels. - Partial-overwrite tricks: low bytes of an address are not randomized (page alignment), so sometimes 1—2 bytes suffice.
Key Takeaway
ASLR + NX means the modern exploit recipe is: leak an address, then ROP. Almost every hard lab reduces to "find a leak."