ASLR

Address Space Layout Randomization (ASLR) is a computer security technique that randomizes the memory layout of a process at load time to make it harder for an attacker to predict the locations of code and data. By varying base addresses of the executable, shared libraries, heap, stack, and other regions, ASLR raises the effort required to perform reliable memory-corruption exploits.

How it works: The loader places code and data at randomized virtual addresses within the process’s address space. For executables and libraries that are built as position-independent (PIE), code and data can be relocated more freely; the kernel may also randomize the stack, heap, and memory-mapped regions. The amount of randomness, or entropy, depends on the architecture and OS; 64-bit systems generally offer more entropy than 32-bit systems. A key goal is that an attacker cannot reliably predict where instructions or data reside.

Scope and limitations: ASLR is widely implemented in modern operating systems for user-space processes, including Linux, macOS, Windows, and BSD variants, and it can also be applied to certain kernel components. It is typically used alongside other defenses such as DEP/NX, stack canaries, and control-flow integrity. ASLR is not a complete safeguard; information leaks, partial randomization, or misconfigurations can reveal addresses and defeat the protection. Binaries that are not fully randomized (for example, non-PIE executables or statically linked code) offer reduced protection, and dynamic loading can complicate the randomization scheme.

History: ASLR emerged from research into preventing memory-corruption exploits and has become a standard feature in modern operating systems, evolving through multiple generations of implementations to increase address-space entropy and reliability.