ASLR NX Canary

ASLR randomizes mappings, NX blocks execute-from-data, canaries detect stack smashes — verify on YOUR $PWN_LAB toys with checksec literacy.

ASLR NX Canary• Audio Walkthrough

00:00/03:27

Visual · pwn_aslr_nx_canary

ASLR/NX/canary literacy. $PWN_LAB only. Original Cyberlium.

Protections raise cost — they do not replace fixing unsafe C; verify them on toys you compile.

ASLR (Address Space Layout Randomization) varies load addresses each run — frustrates fixed-address assumptions. NX/DEP marks pages non-executable — data/stack should not run as code. Stack canaries insert a checked value before return — abort on mismatch. Cyberlium teaches naming and verifying these on YOUR toy binaries at $PWN_LAB via readelf, gcc flags, and checksec — not bypass tutorials. Next: PIE/RELRO.

1. ASLR (named)

PIE executables and shared libraries load at randomized bases when ASLR is enabled in the OS. cat /proc/sys/kernel/randomize_va_space on Linux lab VM — document level for YOUR notes.

Literacy: defenders enable ASLR; attackers historically studied info leaks — your job is verify it is on for shipped builds.

Command guide

Try these commands — ASLR (named)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

NX/DEP literacy — https://man7.org/linux/man-pages/man5/elf.5.html (GNU_STACK segment) Stack canary — https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fstack-protector checksec — https://github.com/slimm609/checksec.sh (NX/Canary/PIE summary)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install build-essential
sudo apt install binutils

macOS:

Command — copy this

xcode-select --install  # or brew install gcc
brew install binutils

Windows: Use WSL or MinGW Use WSL binutils

═══ LINUX / macOS ═══

Optional command

sudo apt install binutils  # readelf objdump

Command — copy this

export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
gcc -Wall -Wno-deprecated-declarations -O0 -g -o "$LAB_PWN/bin/bof_noprotect" "$LAB_PWN/src/bof_vuln.c"
readelf -l "$LAB_PWN/bin/bof_noprotect" | grep -E 'GNU_STACK|RWE'
readelf -d "$LAB_PWN/bin/bof_noprotect" 2>/dev/null | head -8
echo 'ASLR: kernel randomizes load addresses — observe with checksec/readelf, not bypass chains'

Primary tools to practice this lesson: gcc, readelf. Reference sites: NX/DEP literacy (https://man7.org/linux/man-pages/man5/elf.5.html); Stack canary (https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html#index-fstack-protector); checksec (https://github.com/slimm609/checksec.sh). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. NX / DEP (named)

GNU_STACK with RW absent E in readelf -l indicates NX for stack. Attempting execute from stack faults — observed as crash, not shell.

On $PWN_LAB, compare NX on vs intentional -z execstack toy ONLY inside VM to see warning difference — revert snapshot after.

3. Stack canary (named)

Compiler emits canary check in function epilogue — __stack_chk_fail on mismatch. -fstack-protector-strong is common default on many distros.

Ship: protection trio table — ASLR, NX, canary — definition, verify command, expected ON for secure toy build. Next: PIE/RELRO.

4. What you ship: ASLR/NX/canary table for $PWN_LAB

Three protections with verify commands and ON/OFF for YOUR secure toy build. NO bypass steps. chmod 600.

5. What you record before the next lesson

Date. Protection trio table. $PWN_LAB named. File t24-m04-l01-aslr-nx-canary.txt chmod 600.

6. Wrong vs right: weaponized exploits vs memory-safety literacy

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Tutorial to disable all protections globally on production. Publish NX bypass chain.
Right: Write ASLR/NX/canary table with checksec/readelf proof from YOUR toy. Next: PIE/RELRO.

Hands-on Exercise