Quantify the ASLR-versus-NOP-sled contest: with 19 bits of stack entropy at 16-byte granularity, print how many placements each sled size covers and how long a brute-force attack against a respawning server takes.

Answer

ENTROPY_BITS = 19 GRANULARITY = 16 placements = 2 ** ENTROPY_BITS print("ASLR entropy %d bits -> %d possible stack placements" % (ENTROPY_BITS, placements)) for sled in (256, 4096, 65536): covered = sled // GRANULARITY print("sled %5d bytes covers %4d placements -> 1 guess in %5d" % (sled, covered, placements // covered)) tries = placements // (65536 // GRANULARITY) print("respawning server at 20 tries/sec: %.1f seconds on average" % (tries / 20))

Stallings & Brown 5e ch10 §10.2–10.3