[Dailydave] The sky's downward trajectory

[Alexander Sotirov]

Halvar Flake wrote:
> If you consider the number of possible memory states of the process address
> space, there are a lot more than 2^8 -- for each DLL, the randomization will
> consist of 8 bits, but this already provides for ~2^16 possibilities in the 
> case of two DLLs, and more in other cases.

If your goal is to find a specific instruction in memory to use a trampoline to
your shellcode, the number of possible memory states of the entire address space
doesn't matter. You know that the instruction you want is at offset foo.dll+x,
and there are only 2^8 possible places where the dll can be loaded.

The number of tries required to brute force the ASLR in this case is 2^8. If you
have two DLLs that have a trampoline instruction at the same offset, the number
goes down to 2^7, and so on.

Why do you care about the total number of possible states of the entire address
space?

Alex