Randomized stack base PaX
fig. 3 stack smashing attack. target of attack keeps same address; payload moves stack. the randomization of stack base has effect on payload delivery during shellcode , return-to-libc attacks. shellcode attacks modify return pointer field address of payload; while return-to-libc attacks modify stack frame pointer. in either case, probability of success diminished significantly; position of stack unpredictable, , missing payload causes program crash. in case of shellcode, series of instructions called nop slide or nop sled can prepended payload. add 1 more success case per 16 bytes of nop slide. 16 bytes of nop slide increase success rate 1/16m 2/16m; 128 bytes of nop slide increase 9/16m. increase in success rate directly proportional size of nop slide; doubling length of given nop slide doubles chances of successful attack. return-to-libc attacks not use code, rather inject fixed width stack frames. because of this, stack frames have repeat aligned 16 bytes. stack frame bigger this, ...