How can I temporarily disable ASLR (Address space layout randomization)?

Question

I am using Ubuntu 12.04 32-bits, for some experiment I need to disable ASLR; how do I accomplish that? What should I do after that to enable ASLR again?

Answer 1

According to an article How Effective is ASLR on Linux Systems?, you can configure ASLR in Linux using the /proc/sys/kernel/randomize_va_space interface.

The following values are supported:

• 0 – No randomization. Everything is static.
• 1 – Conservative randomization. Shared libraries, stack, mmap(), VDSO and heap are randomized.
• 2 – Full randomization. In addition to elements listed in the previous point, memory managed through brk() is also randomized.

So, to disable it, run

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

and to enable it again, run

echo 2 | sudo tee /proc/sys/kernel/randomize_va_space

This won't survive a reboot, so you'll have to configure this in sysctl. Add a file /etc/sysctl.d/01-disable-aslr.conf containing:

kernel.randomize_va_space = 0

should permanently disable this.

Answer 2

The /proc/sys/kernel/randomize_va_space interface controls ASLR system-wide.

If you don't want a system-wide change, use ADDR_NO_RANDOMIZE personality flag to temporarily disable ASLR. Controlling of this flag can be done with setarch and its -R option, like

setarch `uname -m` -R /bin/bash

This will open a new Bash shell for you with ASLR disabled, including all child processes run from this shell. Just exit the shell once you're done.

---

By the way, on i386, ulimit -s unlimited can effectively "disable" ASLR.

EDIT (Apr 2016): The ulimit -s unlimited was fixed and assigned CVE-2016-3672.

Answer 3

If you want to construct a program which disables ASLR for itself when it runs, you can use the personality system call on Linux. Here's a recipe:

#include <stdio.h>
#include <sys/personality.h>

int main(int argc, char **argv) {
    const int old_personality = personality(ADDR_NO_RANDOMIZE);
    if (!(old_personality & ADDR_NO_RANDOMIZE)) {
        const int new_personality = personality(ADDR_NO_RANDOMIZE);
        if (new_personality & ADDR_NO_RANDOMIZE) {
            execv(argv[0], argv);
        }
    }
    printf("&argc == %p\n", (void *) &argc);
}

If you look at the source for setarch, it calls personality twice in roughly this pattern. The major difference is that setarch calls exec on some other program, whereas my recipe execs itself. It's important that you use non-zero-ness of & ADDR_NO_RANDOMIZE and not equality tests: else you can go into an infinite exec loop if you e.g. compile with -z execstack.

See also the man page for personality.

Answer 4

The more permanent ways of disabling ASLR should be kept in a VM for obvious reasons.

to test the ability to overwrite stack frame return addresses etcetera, you'll need to compile without stack canaries -fno-stack-protector, while to allow you to execute code on the stack you need to compile with -z execstack, making

$ gcc -fno-stack-protector -z execstack -o <my_program> my_code.c

Answer 5

You can use the following command to temporarily disable ASLR.

sudo sysctl kernel.randomize_va_space=0