Defeating KASLR by Doing Nothing at All

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://googleprojectzero.blogspot.com/2025/11/defeating-kaslr-by-doing-nothing-at-all.html
• Blog Title: Defeating KASLR by Doing Nothing at All
• Suggested Section: Linux / Kernel Exploitation -> KASLR/Kernel ASLR Bypasses (ARM64/Android linear map) or Mobile -> Android Security -> Kernel Exploitation & Mitigation Bypasses

🎯 Content Summary

What the post shows
A practical KASLR bypass on arm64 Android kernels (e.g., Google Pixel) by leveraging the deterministic placement of the Linux linear (direct) map. The author needed a kernel VA leak for an exploit with an arbitrary write and instead realized the linear map’s base is effectively fixed, making kernel virtual addresses for physical memory trivially computable across boots.

How the linear map works (arm64)

#define phys_to_virt(x) ((u...
🔧 Technical Details
Direct-map KASLR bypass on arm64: On systems with a fixed linear map, compute kernel virtual addresses for physical memory without a separate KASLR leak using virt = ((phys - PHYS_OFFSET) | PAGE_OFFSET). For Android arm64 with VA_BITS=39, PAGE_OFFSET=0xffffff8000000000. Read PHYS_OFFSET from memstart_addr (often 0x80000000) and then map any known/influenced physical page into the kernel’s VA deterministically.
Leaking/validating PHYS_OFFSET: Query /proc/kallsyms for memstart_addr and use a tracing BPF program calling BPF_FUNC_probe_read_kernel to perform an 8‑byte kernel read of that symbol to confirm its value. Example:
grep memstart /proc/kallsyms → address; then ./bpf_arb_read <addr> 8 to retrieve the bytes (LE → expected 0x80000000).
System design rationale to expect a fixed base: Wi...
🤖 Agent Actions
I analyzed the Project Zero post and added a concise, highly technical subsection documenting the ARM64/Android KASLR bypass via the fixed linear map, including the formula, Android arm64 specifics (VA_BITS=39, PAGE_OFFSET), how to read PHYS_OFFSET from memstart_addr using a tracing BPF helper, and exploitation implications. I also added a short reproduction summary and references.
Updated file:

src/binary-exploitation/common-binary-protections-and-bypasses/aslr/README.md

What I added:

New subsection: “KASLR on ARM64 (Android): bypass via fixed linear map”

arm64 linear map macro definitions and mapping formula: virt = ((phys - PHYS_OFFSET) | PAGE_OFFSET)
Android arm64 specifics: CONFIG_ARM64_VA_BITS=39 → PAGE_OFFSET=0xffffff8000000000, PHYS_OFFSET=memstart_addr
Why it’s fixed: CONFIG_MEMORY_HOTPLUG and arm64 commit 1db780bafa4c removing linear map randomization
Practical steps to leak PHYS_OFFSET on a rooted device: grep memstart in /proc/kallsyms, use bpf_arb_read to read memstart_addr, decode LE, compute direct-map VA
Exploitation impact notes and concise reproduction summary


References section at the end with:

Project Zero blog post
arm64 kernel commit (1db780bafa4c)
Project Zero issue link for bpf_arb_read



Rationale for placement:

This is a mitigation bypass belonging to the general ASLR bypasses page; it directly complements existing ASLR techniques (vsyscall/vDSO) with a kernel-specific ARM64/Android bypass without needing a new page.


This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.
📚 Repository Maintenance

MD files processed: 907
MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://googleprojectzero.blogspot.com/2025/11/defeating-kaslr-by-doing-nothing-at-all.html

Content Categories: Based on the analysis, this content was categorized under "Linux / Kernel Exploitation -> KASLR/Kernel ASLR Bypasses (ARM64/Android linear map) or Mobile -> Android Security -> Kernel Exploitation & Mitigation Bypasses".

Repository Maintenance:

• MD Files Formatting: 907 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0