How can I temporarily disable ASLR (Address space layout randomization)?
According to an article How Effective is ASLR on Linux Systems?, you can configure ASLR in Linux using the /proc/sys/kernel/randomize_va_space
interface.
The following values are supported:
- 0 – No randomization. Everything is static.
- 1 – Conservative randomization. Shared libraries, stack,
mmap()
, VDSO and heap are randomized.- 2 – Full randomization. In addition to elements listed in the previous point, memory managed through
brk()
is also randomized.
So, to disable it, run
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
and to enable it again, run
echo 2 | sudo tee /proc/sys/kernel/randomize_va_space
This won't survive a reboot, so you'll have to configure this in sysctl
. Add a file /etc/sysctl.d/01-disable-aslr.conf
containing:
kernel.randomize_va_space = 0
should permanently disable this.
The /proc/sys/kernel/randomize_va_space
interface controls ASLR system-wide.
If you don't want a system-wide change, use ADDR_NO_RANDOMIZE
personality flag to temporarily disable ASLR. Controlling of this flag can be done with setarch
and its -R
option, like
setarch `uname -m` -R /bin/bash
This will open a new Bash shell for you with ASLR disabled, including all child processes run from this shell. Just exit
the shell once you're done.
By the way, on i386, ulimit -s unlimited
can effectively "disable" ASLR.
EDIT (Apr 2016): The ulimit -s unlimited
was fixed and assigned CVE-2016-3672.
The more permanent ways of disabling ASLR should be kept in a VM for obvious reasons.
to test the ability to overwrite stack frame return addresses etcetera, you'll need to compile without stack canaries -fno-stack-protector
, while to allow you to execute code on the stack you need to compile with -z execstack
, making
$ gcc -fno-stack-protector -z execstack -o <my_program> my_code.c