Address Space Layout Randomization (ASLR) was introduced in 2001 by PaX project as a Linux patch and was integrated into Windows Vista and later OS. It is a memory protection that protects against buffer overflows by randomizing the location where executables are loaded in the memory. Data Execution Prevention (DEP) or no-execute (NX) was also introduced with Internet Explorer 7 on Windows Vista, and it helps prevent buffer overflows by blocking code execution from the memory, which is marked as non-executable.
We need to first evade ASLR. There are basically two ways in which ASLR can be bypassed:
- We look for any anti-ASLR modules being loaded in the memory. We will have the base address of any module at a fixed location. From here, we can use the Return Oriented Programming (ROP) approach. We will basically use small parts of code followed by a return instruction and chain everything to get the desired result:
Source: https://www.slideshare...