And here is an updated example of the previous code, where we have a while, one which is, uh, executing
sleep of one second so it will execute sleep for every one second.
Okay.
Now what we have to do, uh, I want to show in this example is, uh, this is executing.
Okay.
And now it is in the sleep state.
I can get the PID of this, uh, is 42194.
And now if I do a Lf and print the segments, I, I can also see all this information from the proc
pid or the PID value.
Which of this particular process is 42194 and maps.
So here you can see the various things which are getting mapped into the memory.
Here you have uh, this particular thing which is having permissions read permissions like this particular
permissions.
And this is having this follows a particular syntax.
And if you see this LS is mapped into this particular uh virtual address space at this particular location
D002CE.
And this is mapped to this particular location where it has executable permission.
So this means this is uh the text section.
Executable permissions are only given to this particular thing.
So this is having of size to one five.
So and maybe this is aligning the page size.
So it is having extra CE00 to CF00 okay.
And uh yeah.
And you can see the start location also.
So this maps file addresses.
If you see this is currently having like this address.
Now if I stop this one, if I run it again and I'll run this in background.
So I get the PID directly here.
Now if I search the pid P2732, you'll be having different addresses.
Previously it was CFCD00.
It is uh 27400.
So addresses are changing.
It's not like the same address uh here.
So you can see here C library is also mapped this stack.
And there's some other section.
This is a heap.
So but what important point is previously when we run the same code we got this address again I killed
and started again I got a different addresses.
This is happening because of Aslr address space layout randomization.
And this is a security feature to, uh, avoid hat hacking or to avoid attackers and understanding and
performing some injection code injection and all.
So it's time to change the addresses.
The kernel changes addresses.
I can change this feature.
This is a file in Phlox's uh, kernel.
Uh, I think, uh, there's a file.
Let's verify.
I don't really remember this file here.
Randomized virtual address space.
Okay.
So if I run the values uh, of randomized is two, if I change this value to zero, I will not be getting
the virtual address space, uh, getting addresses, getting randomized.
So this should not be done.
I'm just showing you for, uh, how it works if I change it to the zero.
Uh, now.
I will run this code again.
I'll kill this one.
I'll run this again.
Now it is, uh, 43327.
So cat 443327 maps.
File.
It is having this particular address.
Now I will kill this again and start again.
43439.
If you see the addresses are not changing.
Phi Phi Phi all 4004 thousand.
5000.
So it will be the.
It will use the same addresses.
Now the addresses will not be randomized because we have uh, we have disabled the randomized feature
which we should not do.
Now if you run it again.
So you can.
43327943439.
And if I can also enable it again like pseudo, whatever you have done.
So then the SS will start randomizing.
So now if I run this userspace.
43766 will have a different tractors like the P4, it will not have 4000.
So this is the security feature provided by Canaan which is aslr where the addresses will be randomized
each time the new address will be given.
So the previous address will not.
The same memory will not be loaded at the same virtual address space to prevent attackers from attacking
the binary and exploiting it.
Performing binary exploitation will be difficult using this aslr feature.