You are a platform security architect assessing how the operating system's boot and kernel protections hold...

Question

You are a platform security architect assessing how the operating system's boot and kernel protections hold up under this scenario. What is ASLR (Address Space Layout Randomization) on mobile platforms and what specific exploit class does it make harder?

Accepted Answer

ASLR randomizes the base addresses of executable code, heap, stack, and shared libraries at each process launch; this makes it harder to construct reliable ROP (Return-Oriented Programming) chains or jump-to-shellcode exploits because the attacker cannot hardcode target addresses. Both Android (since Android 4.0) and iOS (since iOS 4.3) implement ASLR, making exploitation require an address-leak primitive (an additional vulnerability to discover randomized addresses) before code execution can be reliably redirected.

Answer

ASLR is switched off for system processes on Android, because system_server and Zygote preload the framework and a random base would break the shared page mapping (the loader pins them at a fixed address): only third-party apps get randomization. The exploit class it addresses is the hardcoded return address, and an attack on a system process therefore needs no leak.

Answer

ASLR randomizes the stack base alone, because relocating code or the heap would cost a fixup pass at every launch (the linker resolves absolute addresses once at build time): all mobile platforms leave text and heap fixed. The exploit class it addresses is stack pivoting, and ROP against library gadgets is unaffected.

Answer

ASLR encrypts every memory page under a per-process key, because randomizing addresses alone leaves the contents readable (the MMU decrypts on the way to the core): an attacker who reads memory sees ciphertext. The exploit class it addresses is the information leak, and address reuse stops being useful.

What is ASLR (Address Space Layout Randomization) on mobile platforms and what specific exploit class does it make harder?

Where this fits in the Mobile Security Fundamentals exam

One question down. Thousands to go.

What is ASLR (Address Space Layout Randomization) on mobile platforms and what specific exploit class does it make harder?

Where this fits in the Mobile Security Fundamentals exam

More free Mobile OS Architecture questions

One question down. Thousands to go.