Getting the same address of the local variable in GDB? Think about the address randomization

When playing with GDB this afternoon, I noticed a “strange” behavior.

Even with simple code like

#include <stdio.h>

int main(void)
{
int x = 1;
printf(“x=%d\t address: %p\n”, x, &x);
return 0;
}

In GDB, we always get the same address, even run with different processes:

x=1 address: ffffdd0c

x=1 address: ffffdd0c

The normal behavior should be like below, if run directly in Linux:

./addressTest
x=1 address: 0x7ffff202754c

./addressTest
x=1 address: 0x7ffff202712c

This is due to the fact that in GDB, the disable-randomization is turned on by default. It should be turned off if we expect regular output:

set disable-randomization off

More details here: http://visualgdb.com/gdbreference/commands/set_disable-randomization

https://sourceware.org/gdb/onlinedocs/gdb/Starting.html

From WiKi: Linux kernel enabled a weak form of ASLR by default since the kernel version 2.6.12, released in June 2005.[12] The PaX and Exec Shieldpatchsets to the Linux kernel provide more complete implementations.

This entry was posted in 技术 Tech. Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *