12

Does anybody have a link to a documentation what exactly is randomized in what cases for latest Mac OS (10.7) and iOS (6.0)?

I mean. I want to see a list (something like)

  • Code segment (in a case A,B,C)

  • Stack (always)

  • Heap

  • Data segment (never)

Preferably with how many bits of randomization each thing has.

All I can find is something like: "MacOS Lion implements full ASLR" and in other places "full ASLR is implemented different ways for different operation systems", which is obviously not very informative.

2 Answers 2

18

The list you are looking for can easily be generated by you, as follows:

int global_j = 0;

void main ()
{

    char *h = malloc(10);
    int j = 0;

    printf ("Globals are : %p, text is %p, stack is %p, heap is %p\n",
        &global_j, main, &j, h);

}

On mountain lion, this yields:

bash-3.2# ./a
Globals are : 0x10fa55020, text is 0x10fa54eb0, stack is 0x7fff501ab864, heap is 0x7f9b294000e0
bash-3.2# ./a
Globals are : 0x106bbe020, text is 0x106bbdeb0, stack is 0x7fff59042864, heap is 0x7f9752c000e0
bash-3.2# ./a
Globals are : 0x108673020, text is 0x108672eb0, stack is 0x7fff5758d864, heap is 0x7fecc34000e0
bash-3.2# ./a
Globals are : 0x1059d2020, text is 0x1059d1eb0, stack is 0x7fff5a22e864, heap is 0x7f8f81c000e0

Showing ample randomization on all (note that due to alignment restrictions the offset within the page doesn't get randomized, but you still get some 16-20-bit randomization, as implied by the 4-5 hex digits which change).

  • Kernel: As of Mountain Lion and iOS6, the kernel is randomized by "sliding" it with a value of vm_kernel_slide, on load. Not all vm pages are slid in this way, but for the most part this works by storing some constant value (which is also readable by System call #439, kas_info, on ML but not on iOS: Apple is struggling hard to keep the randomization value secret, and not leak it when reporting kernel addresses, so jailbreakers won't figure out where they can jump to/overwrite - which works for them most of the time)

Hope this helps,

TG

1
  • Few years later, Apple introduced System Integrity Protection feature. Systems after ElCapitan disable kas_info syscall, so don't depend on it. (I think disabling kas_info on ElCapitan was buggy, but it surely is disabled on Sierra, until you disable SIP; then you can use kas_info)
    – antekone
    Oct 31, 2016 at 13:21
8

No PIE:

Executable - Fixed

Data - Fixed

Heap - Randomized per execution

Stack - Fixed

Libraries - Randomized per device boot

Linker - Fixed

With PIE:

Executable - Randomized per execution

Data - Randomized per execution

Heap - Randomized per execution(more entropy)

Stack - Randomized per execution

Libraries - Randomized per device boot

Linker - Randomized per execution

1
  • I did a quick test on Monterey (macOS 12.1, x86_64) and it looked like small allocations via malloc were not randomized under -fno-pie. However, very large allocations (100MB+) did seem to be randomized.
    – nneonneo
    Jan 24, 2022 at 9:38

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.