From: Alexander Sotirov (asotirovdetermina.com)
Date: Tue Feb 20 2007 - 16:42:47 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Halvar Flake wrote:
> If you consider the number of possible memory states of the process address
> space, there are a lot more than 2^8 -- for each DLL, the randomization will
> consist of 8 bits, but this already provides for ~2^16 possibilities in the
> case of two DLLs, and more in other cases.

If your goal is to find a specific instruction in memory to use a trampoline to
your shellcode, the number of possible memory states of the entire address space
doesn't matter. You know that the instruction you want is at offset foo.dll+x,
and there are only 2^8 possible places where the dll can be loaded.

The number of tries required to brute force the ASLR in this case is 2^8. If you
have two DLLs that have a trampoline instruction at the same offset, the number
goes down to 2^7, and so on.

Why do you care about the total number of possible states of the entire address
space?

Alex
_______________________________________________
Dailydave mailing list
Dailydavelists.immunitysec.com
http://lists.immunitysec.com/mailman/listinfo/dailydave

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]