# aslr/pie intro

With exploiting binaries, there are various mitigations that you will face that will make it harder to exploit. Defeating them is usually just one step for actually gaining control over a program (assuming that the mitigation stands in your way). Since it is just something that stands in your way, and since for the modules I like to cover a new type of bug / exploitation technique, I didn't make a module dedicated to each of the mitigations you will see. However you still do see them (or some combination of the,) nearly everywhere through this project. So the purpose of these is to give you a brief explanation as to what they are.

So what is address space randomization (aslr)? Processes have memory. All of the memory addresses to each byte. Aslr randomization that in certain memory region such as the stack and the heap. This keeps us from knowing what the memory addresses are for certain regions of memory.

For instance, let's take a look at the address of this one stack variable, one iteration of running this binary:

```
Breakpoint 1, 0x[PII_REDACTED]401161 in main ()
[ Legend: Modified register | Code | Heap | Stack | String ]
───────────────────────────────────────────────────────────────── registers ────
$rax   : 0x00007fffabfee6fe  →  0x7fffabfee7f0000a
$rbx   : 0x0               
$rcx   : 0xfbad2088        
$rdx   : 0x00007fffabfee6fe  →  0x7fffabfee7f0000a
$rsp   : 0x00007fffabfee6f0  →  0x[PII_REDACTED]401180  →  <__libc_csu_init+0> push r15
$rbp   : 0x00007fffabfee710  →  0x[PII_REDACTED]401180  →  <__libc_csu_init+0> push r15
$rsi   : 0x00007f4512ce4590  →  0x[PII_REDACTED]000000
$rdi   : 0x0               
$rip   : 0x[PII_REDACTED]401161  →  <main+47> mov DWORD PTR [rbp-0x18], 0x5
$r8    : 0x[PII_REDACTED]100010  →  0x[PII_REDACTED]000000
$r9    : 0x63              
$r10   : 0x00007f4512ce1ca0  →  0x[PII_REDACTED]101260  →  0x[PII_REDACTED]000000
$r11   : 0x246             
$r12   : 0x[PII_REDACTED]401050  →  <_start+0> xor ebp, ebp
$r13   : 0x00007fffabfee7f0  →  0x[PII_REDACTED]000001
$r14   : 0x0               
$r15   : 0x0               
$eflags: [ZERO carry PARITY adjust sign trap INTERRUPT direction overflow resume virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000
───────────────────────────────────────────────────────────────────── stack ────
0x00007fffabfee6f0│+0x0000: 0x[PII_REDACTED]401180  →  <__libc_csu_init+0> push r15 ← $rsp
0x00007fffabfee6f8│+0x0008: 0x000a[PII_REDACTED]50
0x00007fffabfee700│+0x0010: 0x00007fffabfee7f0  →  0x[PII_REDACTED]000001
0x00007fffabfee708│+0x0018: 0x29e19ee33cdef200
0x00007fffabfee710│+0x0020: 0x[PII_REDACTED]401180  →  <__libc_csu_init+0> push r15 ← $rbp
0x00007fffabfee718│+0x0028: 0x00007f4512b23b6b  →  <__libc_start_main+235> mov edi, eax
0x00007fffabfee720│+0x0030: 0x[PII_REDACTED]000000
0x00007fffabfee728│+0x0038: 0x00007fffabfee7f8  →  0x00007fffabfef410  →  0x4e[PII_REDACTED]2f2e ("./try"?)
─────────────────────────────────────────────────────────────── code:x86:64 ────
     0x401154 <main+34>        mov    esi, 0x9
     0x401159 <main+39>        mov    rdi, rax
     0x40115c <main+42>        call   0x401040 <fgets@plt>
 →   0x401161 <main+47>        mov    DWORD PTR [rbp-0x18], 0x5
     0x401168 <main+54>        nop    
     0x401169 <main+55>        mov    rax, QWORD PTR [rbp-0x8]
     0x40116d <main+59>        xor    rax, QWORD PTR fs:0x28
     0x401176 <main+68>        je     0x40117d <main+75>
     0x401178 <main+70>        call   0x401030 <__stack_chk_fail@plt>
─────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "try", stopped, reason: BREAKPOINT
───────────────────────────────────────────────────────────────────── trace ────
[#0] 0x401161 → main()
────────────────────────────────────────────────────────────────────────────────
gef➤  x/g $rbp-0x18
0x7fffabfee6f8:    0xa[PII_REDACTED]50
```   

We can see that for this iteration, the variable at `rbp-0x18` has the address `0x7fffabfee6f8`. Let's see what the address is on another iteration of running the binary:

```
Breakpoint 1, 0x[PII_REDACTED]401161 in main ()
[ Legend: Modified register | Code | Heap | Stack | String ]
───────────────────────────────────────────────────────────────── registers ────
$rax   : 0x00007ffcdc7caf6e  →  0x7ffcdc7cb060000a
$rbx   : 0x0               
$rcx   : 0xfbad2088        
$rdx   : 0x00007ffcdc7caf6e  →  0x7ffcdc7cb060000a
$rsp   : 0x00007ffcdc7caf60  →  0x[PII_REDACTED]401180  →  <__libc_csu_init+0> push r15
$rbp   : 0x00007ffcdc7caf80  →  0x[PII_REDACTED]401180  →  <__libc_csu_init+0> push r15
$rsi   : 0x00007ff338fda590  →  0x[PII_REDACTED]000000
$rdi   : 0x0               
$rip   : 0x[PII_REDACTED]401161  →  <main+47> mov DWORD PTR [rbp-0x18], 0x5
$r8    : 0x[PII_REDACTED]3b9010  →  0x[PII_REDACTED]000000
$r9    : 0x63              
$r10   : 0x00007ff338fd7ca0  →  0x[PII_REDACTED]3ba260  →  0x[PII_REDACTED]000000
$r11   : 0x246             
$r12   : 0x[PII_REDACTED]401050  →  <_start+0> xor ebp, ebp
$r13   : 0x00007ffcdc7cb060  →  0x[PII_REDACTED]000001
$r14   : 0x0               
$r15   : 0x0               
$eflags: [ZERO carry PARITY adjust sign trap INTERRUPT direction overflow resume virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000
───────────────────────────────────────────────────────────────────── stack ────
0x00007ffcdc7caf60│+0x0000: 0x[PII_REDACTED]401180  →  <__libc_csu_init+0> push r15 ← $rsp
0x00007ffcdc7caf68│+0x0008: 0x000a[PII_REDACTED]50
0x00007ffcdc7caf70│+0x0010: 0x00007ffcdc7cb060  →  0x[PII_REDACTED]000001
0x00007ffcdc7caf78│+0x0018: 0x7065c5c264020400
0x00007ffcdc7caf80│+0x0020: 0x[PII_REDACTED]401180  →  <__libc_csu_init+0> push r15 ← $rbp
0x00007ffcdc7caf88│+0x0028: 0x00007ff338e19b6b  →  <__libc_start_main+235> mov edi, eax
0x00007ffcdc7caf90│+0x0030: 0x[PII_REDACTED]000000
0x00007ffcdc7caf98│+0x0038: 0x00007ffcdc7cb068  →  0x00007ffcdc7cb410  →  0x4e[PII_REDACTED]2f2e ("./try"?)
─────────────────────────────────────────────────────────────── code:x86:64 ────
     0x401154 <main+34>        mov    esi, 0x9
     0x401159 <main+39>        mov    rdi, rax
     0x40115c <main+42>        call   0x401040 <fgets@plt>
 →   0x401161 <main+47>        mov    DWORD PTR [rbp-0x18], 0x5
     0x401168 <main+54>        nop    
     0x401169 <main+55>        mov    rax, QWORD PTR [rbp-0x8]
     0x40116d <main+59>        xor    rax, QWORD PTR fs:0x28
     0x401176 <main+68>        je     0x40117d <main+75>
     0x401178 <main+70>        call   0x401030 <__stack_chk_fail@plt>
─────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "try", stopped, reason: BREAKPOINT
───────────────────────────────────────────────────────────────────── trace ────
[#0] 0x401161 → main()
────────────────────────────────────────────────────────────────────────────────
gef➤  x/g $rbp-0x18
0x7ffcdc7caf68:    0xa[PII_REDACTED]50
```

This time we can see that the address is `0x7ffcdc7caf68`, so it has changed. Also one quick note, when you run a binary straight up in gdb,