multiple libraries, and shown below as well. Note that the case of an attacker using only one library is a simplification of the more complex formula for . (number of libraries loaded) (number of libraries used by the attacker) These values tend to be low even for large values of , most importantly since attackers typically can use only the C standard library and thus one can often assume that . However, even for a small number of libraries there are a few bits of entropy gained here; it is thus potentially interesting to combine library load order randomization with VMA address randomization to gain a few extra bits of entropy. Note that these extra bits of entropy will not apply to other mmap() segments, only libraries. Reducing entropy Attackers may make use of several methods to reduce the entropy present in a randomized address space, ranging from simple information leaks to attacking multiple bits of entropy per attack (such as by heap spraying). There is little that can be done about this. It is possible to leak information about memory layout using format string vulnerabilities. Format string functions such as printf use a variable argument list to do their job; format specifiers describe what the argument list looks like. Because of the way arguments are typically passed, each format specifier moves closer to the top of the stack frame. Eventually, the return pointer and stack frame pointer can be extracted, revealing the address of a vulnerable library and the address of a known stack frame; this can eliminate library and stack randomization as an obstacle to an attacker. One can also decrease entropy in the stack or heap. The stack typically must be aligned to 16 bytes, and so this is the smallest possible randomization interval; while the heap must be page-aligned, typically 4096 bytes. When attempting an attack, it is possible to align duplicate attacks with these intervals; a NOP slide may be used with shellcode injection, and the string '' can be replaced with '' for an arbitrary number of slashes when attempting to return to system. The number of bits removed is exactly for intervals attacked. Such decreases are limited due to the amount of data in the stack or heap. The stack, for example, is typically limited to and grows to much less; this allows for at most , although a more conservative estimate would