Adding ASLR to Jailbroken iPhones [PDF] - Antid0te

Stack Randomization Test
int main()
{
char buffer[1024];
}
printf("%08x\n", buffer);
lib:/tmp root# ./xxx
2fffef88
lib:/tmp root# ./xxx
2ccd8f88
lib:/tmp root# ./xxx
2bf5af88
lib:/tmp root# ./xxx
2e7a5f88
lib:/tmp root# ./xxx
2e9b0f88
lib:/tmp root# ./xxx
2abf3f88
lib:/tmp root# ./xxx
2ce31f88
Stefan Esser • Adding ASLR to jailbroken iPhones • December 2010 •
47