System-level exploit development relies heavily on predictable binary geometry. Standard coarse-grained ASLR randomizes where a binary loads in memory, but the relative distances between internal functions, gadgets, and control structures remain entirely fixed. Once an attacker leaks a single base address, the internal binary layout becomes predictable, allowing 1-day and N-day exploits to remain possible

The talk will introduce memory attacks, give a brief historical timeline of memory safety mitigations, and go through the evolution from early execution prevention to coarse-grained ASLR and then go into fine-grained layout randomization. By randomizing code at the function and basic-block level, fine-grained ASLR can break many of the spatial assumptions that modern memory corruption exploits depend on.

The talk will then examine why fine-grained ASLR remains unreliable in practice then propose approaches to address these weaknesses.

---

Armand Alexandru Balint

Armand works in system security and security research at Huawei in Helsinki. He specializes in malware and EDR solutions, with just about enough binary analysis on the side. He has an unhealthy appreciation for control-flow obfuscation, and firmly believes that every technical presentation requires at least one unwarranted and poorly timed pun.

---