Why is the address of __libc_start_main always the same inside GDB even though ASLR is on?

Question

Breakpoint 1, 0x00007ffff7de8060 in __libc_start_main () from /usr/lib/libc.so.6
(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/firstlove/projects/org-ioslide/example/a.out 

Breakpoint 1, 0x00007ffff7de8060 in __libc_start_main () from /usr/lib/libc.so.6
(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/firstlove/projects/org-ioslide/example/a.out 

Breakpoint 1, 0x00007ffff7de8060 in __libc_start_main () from /usr/lib/libc.so.6
(gdb) Quit
(gdb) quit
A debugging session is active.

        Inferior 1 [process 16372] will be killed.

Quit anyway? (y or n) y
firstlove-pc% cat /proc/sys/kernel/randomize_va_space
2

IIUC, ASLR should randomize all address, including the one of libc.so, but I found that the address of __libc_start_main() is always 0x00007ffff7de8060 on my Linux machine, why? What is wrong?

Does address space randomization also randomize function addresses or only those of variables? — rubenvb, Jan 16 '20 at 15:06
Do you see the same result if you start a new gdb session in which to check the address, instead of rerunning the program in the same gdb session? — John Bollinger, Jan 16 '20 at 15:08

score 26 · Accepted Answer · answered Jan 16 '20 at 15:07

26

When you run a program inside gdb, gdb tries to help you debugging by disabling address randomization. You can use the following command to enable it (effective from the next run of the program):

set disable-randomization off

answered Jan 16 '20 at 15:07

Marco Bonelli

63,369
21
118
128

Why is the address of __libc_start_main always the same inside GDB even though ASLR is on?

1 Answers1

Linked