What is ASLR (Address Space Layout Randomization) on mobile platforms and what specific exploit class does it make harder?

• A.ASLR randomizes the base addresses of executable code, heap, stack, and shared libraries at each process launch; this makes it harder to construct reliable ROP (Return-Oriented Programming) chains or jump-to-shellcode exploits because the attacker cannot hardcode target addresses. Both Android (since Android 4.0) and iOS (since iOS 4.3) implement ASLR, making exploitation require an address-leak primitive (an additional vulnerability to discover randomized addresses) before code execution can be reliably redirected.
• B.ASLR is switched off for system processes on Android, because system_server and Zygote preload the framework and a random base would break the shared page mapping (the loader pins them at a fixed address): only third-party apps get randomization. The exploit class it addresses is the hardcoded return address, and an attack on a system process therefore needs no leak.