rzhou·14 anni fa·discussOn 32-bit machines, you can disable mmap randomization (and thus library randomization) using ulimit -s unlimited.Also, there's another useful place you can return to that isn't in libc.
rzhou·15 anni fa·discussOn 32-bit systems, it's feasible to brute force, as there are only about 12 bits of entropy. There are a lot more random bits on 64-bit systems, so I don't consider it brute force to be that practical there.
rzhou·15 anni fa·discussIt doesn't stop the exploit, as it is still possible to use ptrace to essentially dump the binary, even though it's not readable.
Also, there's another useful place you can return to that isn't in libc.