Address Obfuscation: An Efficient Approach to Combat a Broad Range of Memory Error Exploits

Attacks which exploit memory programming errors (such as buffer overflows) are one of today's most serious security threats. These attacks require an attacker to have an in-depth understanding of the internal details of a victim program, including the locations of critical data and/or code. Program obfuscation is a general technique for securing programs by making it difficult for attackers to acquire such a detailed understanding. This paper develops a systematic study of a particular kind of obfuscation called address obfuscation that randomizes the location of victim program data and code. It discusses different implementation strategies to randomize the absolute locations of data and code, as well as relative distances between data locations.