ASLR: the techniques to defeat it

ASLR randomizes the bases of stack, heap, libc and (with PIE) the binary. Without knowing an address, you cannot aim gadgets or functions. The attacks recover that information.

The roads

Info leak: the main one. A format string or overread prints a pointer; by difference you compute the module base.

No PIE: if the binary is not PIE, its code sits at fixed addresses — gadgets and PLT are known even with randomized libc.

Low entropy: on 32-bit the randomized bits are few; brute-force is feasible, especially with fork().

Relative arithmetic: known offsets within the same module do not depend on the base.

Defence

Always compile PIE (-fPIE -pie), remove leaks, use Full RELRO, and on modern systems high entropy. ASLR is only strong if no address leaks.