# Address Space Layout Randomization Next Generation
## 8 Evaluation
### Absolute Address Entropy  
Absolute entropy is the effective entropy of an object when it is considered independently. Each ASLR has been tested in two different systems:  
* **32-bits:** a 32-bit x86 architecture, without PAE. Note that when an i386 application is executed in a x86_64 system, the memory layout is different. Our experiments are executed in a truly 32-bit system, and so the virtual memory space available to any process is 3 GB. * **64-bits:** a 64-bit x86_64 architecture. The virtual memory space available for the user is \(2^{47}\) bytes. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Feature and Forms** & **OS X** & **Linux** & **PaX** & **ASLR-NG** \\ \hline ASLR per-exec & & ✓ & ✓ & ✓ \\ Inter-object in stack, exec. and heap & ✓ & ✓ & ✓ & ✓ \\ Sub-page in main stack & ✓ & ✓ & ✓ & ✓ \\ Sub-page in ARGV and heap (brk) & & & ✓ & ✓ \\ Inter-object in LD and vDSO & & & & ✓ \\ Inter-object in thread stacks & & & & ✓ \\ Sub-page in thread stacks & & & & ✓ \\ Load libraries order randomized & & & & ✓ \\ Multiple specific-zone support & & & & ✓ \\ Randomize specific-zones per child & & & & ✓ \\ Bit-slicing randomization & & & ✓ \\ Sub-page per mmap request & & & ✓ \\ Inter-object per mmap request & & & ✓ \\ Uniform distribution & & & ✓ \\ Full VM range & & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparative summary of features. Table 5 shows the measured entropy bits obtained in Linux, PaX, OS X and ASLR-NG in both 32- and 64-bit systems. Note that the ASLR-NG absolute entropy is the same for all modes. All the data presented in this section are the result of running the sampler tool to collect a million samples for each system which is more than enough for the virtual memory space. ARGV is the page in memory that hold the program arguments. **Linux:** In 32-bit systems, Linux provides only 8 random bits for most objects, which is too low a value to be effective and can be considered defeated. In 64 bits, although randomization is higher for most objects, there are still some objects (vDSO and ARGV) with much lower entropy, which in turn may encourage attackers to use them. Huge pages are less randomized, due to alignment constraints. In particular, in 32-bit systems, alignment resets those bits that ASLR randomizes, and so huge pages are not randomized at all. Moreover, in 64-bit systems, huge pages have 19 random bits, which gives some protection but still may not deter local or remotely distributed attackers. **PaX/Grsecurity:** In 32 bits, PaX provides much more entropy than Linux in all objects. The libraries and mmapped objects have 15.72 bits of entropy, in which case a brute force attack, at 100 trials per second, will need a few minutes to bypass the PaX ASLR. The lowest randomized object (but huge pages) is the executable. Surprisingly in 64-bit systems, the entropy of Executables in PAX is less than the entropy in Linux. The additional entropy bits of the ARGV, main stack and heap are due to sub-page randomization. The decimal values of the mmapped objects are caused by non-uniform distribution--as explained in Section 5.2. PaX is much better than Linux in 32 bits, but quite similar in 64 bits. **OS X:** ASLR is broken in OS X for local attackers for both 32- and 64-bit systems and is weak for remote attackers. As Table 4 shows, OS X implements its ASLR per boot. That is, all objects except the executable, are only randomized after the system is rebooted. Therefore it provides no protection against local attackers and its ASLR in both 32 and 64-bits must be considered _broken_ for local attackers. The OS X entropy showed in Table 5 only apply for remote attackers. In 32-bit systems it provides a similar protection than Linux but in 64-bit the entropy provided is very low allowing potential attackers to bypass the OS X ASLR with little effort.