kasld

(★ 521)

KASLD derandomizes the Linux kernel's virtual and physical memory layout from a local process, using whatever its vantage — privilege, configuration, and confinement — allows.

File Explorer

Download Latest Version (.zip)

Showing a partial file list — download the zip above to see everything.

- - _cross-build.yml
  - build.yml
  - clang-format.yml
  - codeql.yml
  - release.yml
  - replay.yml
- - address-space-map.svg
  - arch-coupling-quadrant.svg
  - architecture.svg
  - bypass-technique-map.svg
  - engine-dataflow.svg
  - estimate-narrowing.svg
  - exploitation-pipeline.svg
  - kaslr-runtime-states.svg
  - seams.svg
  - two-window-resolution.svg
  - vantage.svg
  - wire-line-anatomy.svg
- architecture.md
- bypass-techniques.md
- exploitation.md
- footprint.md
- kaslr.md
- limitations.md
- reproducibility.md
- testing.md
- usage.md
- anonymize-fdt
- check-hardware-vulnerabilities
- check-results
- collect
- ksymoff
- posture-diff
- posture-summary
- README.md
- sudo-proc-kallsyms
- validate-bundle
- weaken-kernel-hardening
- kasld.1
- ksymoff.1
- - acpi_mrrm.c
  - alsa_seq_ext_ptr.c
  - arm64_no_seed.c
  - bcm_msg_head_struct.c
  - boot_config.c
  - boot_params_e820.c
  - boot_params_facts.c
  - bootconfig_facts.c
  - bpf_verifier_ksym.c
  - bpf_verifier_log.c
  - btf_struct_page_size.c
  - cmdline_hugepages.c
  - cmdline_mem.c
  - cmdline_memmap.c
  - cmdline_region.c
  - cpuinfo_facts.c
  - databounce.c
  - devicetree_facts.c
  - dmesg_acpi_dynamic_ssdt.c
  - dmesg_android_ion_snapshot.c
  - dmesg_backtrace.c
  - dmesg_check_for_initrd.c
  - dmesg_cma_reserved.c
  - dmesg_crashkernel.c
  - dmesg_driver_component_ops.c
  - dmesg_e820_memory_map.c
  - dmesg_early_init_dt_add_memory_arch.c
  - dmesg_efi_memmap.c
  - dmesg_ex_handler_msr.c
  - dmesg_fake_numa_init.c
  - dmesg_free_area_init_node.c
  - dmesg_free_reserved_area.c
  - dmesg_kaslr_disabled.c
  - dmesg_last_pfn.c
  - dmesg_mem_init_kernel_layout.c
  - dmesg_mmu_idmap.c
  - dmesg_node_data.c
  - dmesg_ramdisk.c
  - dmesg_reserved_mem.c
  - dmesg_reserved_mem_opensbi.c
  - dmesg_riscv_relocation.c
  - dmesg_swiotlb.c
  - echoload.c
  - efi_present.c
  - entrybleed.c
  - fdt_facts.c
  - firmware_memmap.c
  - function_order_fingerprint.c
  - hibernation_nokaslr.c
  - ioctl_mmio_phys.c
  - kernel_image_facts.c
  - kernel_notes_buildid.c
  - kernelsnitch.c
  - kernfs_ns_hash.c
  - loongarch_kexec_file_nokaslr.c
  - mali_timeline.c
  - meminfo_facts.c
  - mincore.c
  - mmap_arm64_va_bits.c
  - mmap_brute_vmsplit.c
  - mmap_riscv64_va_bits.c
  - mmap_s390_va_bits.c
  - mmap_x86_64_va_bits.c
  - nilfs2_ioctl.c
  - page_size.c
  - perf_amd_branch_user.c
  - perf_event_open.c
  - perf_ksymbol_leak.c
  - perf_lbr_sampling.c
  - perf_text_poke_leak.c
  - pppd_kallsyms.c
  - prefetch.c
  - prefetch_directmap.c
  - proc_cmdline.c
  - proc_config.c
  - proc_cpuinfo.c
  - proc_iomem_kernel.c
  - proc_kallsyms.c
  - proc_kcore.c
  - proc_modules.c
  - proc_net_sock_ptr.c
  - proc_pid_syscall.c
  - proc_stat_wchan.c
  - proc_timer_list.c
  - proc_zoneinfo.c
  - qemu_tcg_iret.c
  - riscv64_no_seed.c
  - s390_kdump_nokaslr.c
  - sidt.c
  - sysfs_cbmem_address.c
  - sysfs_cxl_region.c
  - sysfs_devicetree_elfcorehdr.c
  - sysfs_devicetree_initrd.c
  - sysfs_devicetree_kernel_end.c
  - sysfs_devicetree_memory.c
  - sysfs_devicetree_memory_limit.c
  - sysfs_devicetree_mmio.c
  - sysfs_devicetree_reserved_memory.c
  - sysfs_devicetree_uefi_mmap.c
  - sysfs_efi_runtime_map.c
  - sysfs_firmware_memmap.c
  - sysfs_iommu_reserved_regions.c
  - sysfs_iscsi_transport_handle.c
  - sysfs_kernel_notes_xen.c
  - sysfs_memory_blocks.c
  - sysfs_module_sections.c
  - sysfs_nd_region.c
  - sysfs_nf_conntrack.c
  - sysfs_pci_resource.c
  - sysfs_qcom_rmtfs_mem.c
  - sysfs_uio_map.c
  - sysfs_vmcoreinfo.c
  - tracefs_available_filter_addrs.c
  - tracefs_printk_formats.c
  - zfs_dbgmsg.c
  - zombieload.c
- - cmdline.h
  - cpu.h
  - dmesg.h
  - kconfig.h
  - prefetch_scan.h
  - sidechannel.h
  - syslog.h
  - text_order.h
- - hardening.c
  - json.c
  - markdown.c
  - oneline.c
  - text.c
- - arm64_coupling_validate.c
  - arm64_efi_kimg_align.c
  - arm64_memstart_align.c
  - arm64_page_offset_from_va_bits.c
  - arm64_phys_text_residue.c
  - arm64_text_base.c
  - arm64_text_phys_residue.c
  - arm64_va47_modern_floor.c
  - arm64_va_bits_from_directmap.c
  - arm64_va_bits_from_scalar.c
  - arm64_va_bits_from_vmemmap.c
  - base_align_cross_validate.c
  - boot_params_kaslr_align.c
  - ceiling_from_image_size.c
  - cmdline_mem_phys_ceiling.c
  - cmdline_mem_virt_ceiling.c
  - cmdline_memmap_phys_exclude.c
  - cmdline_memmap_too_large_phys_pin.c
  - cmdline_phys_exclude.c
  - config_max_offset_ceiling.c
  - constraint_passthrough.c
  - coupling_validate.c
  - directmap_kaslr_disabled_pin.c
  - directmap_page_offset_bounds.c
  - dram_ceiling.c
  - dram_floor_bound.c
  - efi_loader_kernel_pick.c
  - firmware_memmap_holes.c
  - highmem_32bit_bound.c
  - image_base_grid_align.c
  - image_base_resolved_grid_align.c
  - image_floor_from_init_size.c
  - image_size_text_data_gap.c
  - initrd_above_kernel.c
  - initrd_phys_exclude.c
  - kaslr_align_arch_default.c
  - kernel_image_phys_bound.c
  - loongarch64_coupling_validate.c
  - min_offset_from_image_size.c
  - mmio_floor_phys_ceiling.c
  - module_base_bounds.c
  - module_base_execmem_window.c
  - module_base_from_text.c
  - module_base_from_va_bits.c
  - module_base_ppc64_vmalloc.c
  - module_text_bound.c
  - module_text_bracket.c
  - page_offset_from_config.c
  - page_offset_from_landmark.c
  - page_offset_from_leak.c
  - page_offset_invariant_pin.c
  - page_offset_text_floor.c
  - phys_bits_ceiling.c
  - phys_ceiling_from_memtotal.c
  - phys_hole_filter.c
  - phys_kaslr_disabled_pin.c
  - phys_reservation_exclude.c
  - phys_virt_synth.c
  - physical_start_lower_bound.c
  - ppc32_phys_ceiling.c
  - ppc64_firmware_ceiling.c
  - ram_map_phys_exclude.c
  - randomize_memory_page_offset.c
  - range_from_interior.c
  - riscv64_coupling_validate.c
  - riscv64_fdt_kaslr_seed.c
  - riscv64_non_efi_phys_base.c
  - riscv64_page_offset_from_vmalloc_vmemmap.c
  - riscv64_text_base.c
  - riscv64_va_bits_pin.c
  - s390_image_base_from_config.c
  - s390_paging_level.c
  - s390_phys_segment_mod.c
  - s390_text_from_belows.c
  - s390_text_no_random.c
  - s390_text_segment_mod.c
  - text_base_coupling_synth.c
  - text_cluster_filter.c
  - text_pin_from_observation.c
  - virt_ceiling_from_memtotal.c
  - virt_kaslr_disabled_pin.c
  - vmsplit_text_base.c
  - x86_32_vmsplit_ceiling.c
  - x86_64_efi_phys_seed_zero.c
  - x86_64_la57_from_directmap.c
  - x86_64_page_offset_floor_from_va_bits.c
  - x86_64_page_offset_from_vmalloc_vmemmap.c
  - x86_64_randomize_memory_budget.c
  - x86_64_va_bits_from_scalar.c
  - x86_64_vmalloc_base_bound.c
  - x86_64_vmalloc_vmemmap_invariant.c
  - x86_64_vmemmap_base_bound.c
- engine.c
- engine_rules.c
- environment.c
- estimate.c
- evidence.c
- orchestrator.c
- quantities.c
- region_info.c
- render.c
- - fork-fail.c
  - README.md
  - run
  - seccomp-exec.c
- check-absence-vs-denial
- check-addr-parse
- check-arch-macros
- check-baseline
- check-component-cap
- check-component-meta
- check-component-output
- check-confidence-floor
- check-covering-consumers
- check-discard-accounting
- check-discard-ledger
- check-discard-report
- check-dram-base
- check-env-docs
- check-extent-callers
- check-fdt-unflatten
- check-guard-docs
- check-hash-parity
- check-image-size
- check-ksymoff
- check-lattice-seam
- check-live-probes
- check-log-prefixes
- check-manpages
- check-page-offset-substitution
- check-posture-diff
- check-posture-summary
- check-readout-docs
- check-render-color
- check-render-default
- check-render-parity
- check-render-width
- check-rule-registry
- check-scalar-seed-order
- check-self-edges
- check-shellcheck
- check-test-staging
- check-text-floor
- check-text-provenance
- check-text-region
- check-truncation
- check-validators
- check-vantage-coverage
- check-version
- check_hash_parity.c
- cli-flags
- coverage
- coverage-e2e
- fdt-unflatten
.clang-format
.clang-format-ignore
.gitattributes
.gitignore
CITATION.cff
CONTRIBUTING.md
LICENSE
logo.png
Makefile
README.md
THIRD-PARTY-NOTICES.md
VERSION

# Installation Guide

1. Get the code

git clone https://github.com/bcoles/kasld

Downloads the entire project code from GitHub to your computer.

cd kasld

Moves into the project folder you just downloaded.

2. Official Install Script

Easy Recommended

Prerequisites

APT (Debian/Ubuntu 계열) Built into Debian/Ubuntu-based Linux distributions.

sudo apt install libc-dev make gcc binutils git

Installs directly from the APT package repository (Debian/Ubuntu-based).

✅ After installing, open a new terminal and run the program's version command (e.g. --version) to confirm it worked.

Pulled directly from this repo's README.

3. Make

Medium

Prerequisites

Git Needed to download the project code from GitHub.
Make Usually pre-installed on Linux/macOS. On Windows, install separately (e.g. via MSYS2 or WSL).

make