bplant wrote:
Any ideas why the ET_DYN test isn't showing the mmap randomisation value?
maybe the test itself was miscompiled (as the kernel part is really trivial and hard to get wrong, look at the code using delta_exec). first make sure you're using -test5 and Makefile.psm then verify that getmain2 is ET_DYN and when run manually, it prints random numbers, not all 0s.
I downloaded paxtest-0.9.7-pre5.tar.gz and compiled it by running "make -f Makefile.psm". This produced the following output:
- Code: Select all
Mode: blackhat
Linux vancouver 2.6.16.18-xen-grsec #5 SMP Wed Jun 28 17:10:35 EST 2006 x86_64 Intel(R) Pentium(R) D CPU 3.00GHz GenuineIntel GNU/Linux
Executable anonymous mapping : Killed
Executable bss : Killed
Executable data : Killed
Executable heap : Killed
Executable stack : Killed
Executable anonymous mapping (mprotect) : Killed
Executable bss (mprotect) : Killed
Executable data (mprotect) : Killed
Executable heap (mprotect) : Killed
Executable stack (mprotect) : Killed
Executable shared library bss (mprotect) : Killed
Executable shared library data (mprotect): Killed
Writable text segments : Killed
Anonymous mapping randomisation test : 33 bits (guessed)
Heap randomisation test (ET_EXEC) : 40 bits (guessed)
Heap randomisation test (ET_DYN) : 40 bits (guessed)
Main executable randomisation (ET_EXEC) : 32 bits (guessed)
Main executable randomisation (ET_DYN) : 32 bits (guessed)
Shared library randomisation test : 33 bits (guessed)
Stack randomisation test (SEGMEXEC) : No randomisation
Stack randomisation test (PAGEEXEC) : 40 bits (guessed)
Return to function (strcpy) : Killed
Return to function (memcpy) : Killed
Return to function (strcpy, RANDEXEC) : Killed
Return to function (memcpy, RANDEXEC) : Killed
Executable shared library bss : Killed
Executable shared library data : Killed
For interest sake, I recompiled using "make -f Makefile.Adamantix" and reran paxtest. Most of the results were the same, except for these:
- Code: Select all
Stack randomisation test (SEGMEXEC) : 40 bits (guessed)
Return to function (strcpy, RANDEXEC) : paxtest: return address contains a NULL byte.
I couldn't compile the paxtest using the Gentoo makefile, even though I run Gentoo
![;)](./images/smilies/icon_wink.gif)
Is there a reason why the results are different when the different Makefiles are used? If one method can circumvent the randomisation, does this mean that the machine is more vulnerable? Or are they different because paxtest simulates exploits, not applications?
Cheers,
Brad