What is ASLR (Address Space Layout Randomization) on mobile platforms and what specific exploit class does it make harder?
- A.C) ASLR only randomizes the stack base address; heap and code sections remain at fixed addresses on mobile platforms.
- B.B) ASLR encrypts all memory pages; an attacker who reads memory sees only ciphertext, preventing exploitation.
- C.A) ASLR randomizes the base addresses of executable code, heap, stack, and shared libraries at each process launch; this makes it harder to construct reliable ROP (Return-Oriented Programming) chains or jump-to-shellcode exploits because the attacker cannot hardcode target addresses. Both Android (since Android 4.0) and iOS (since iPhone OS 3) implement ASLR, making exploitation require an address-leak primitive (an additional vulnerability to discover randomized addresses) before code execution can be reliably redirected.