为什么C变量的内存地址不固定？

Question

I'm an undergraduate CS student who just learned about virtual memory. I did an experiment with the following program.

#include<stdio.h>
int ready0; 
int main(void) {
  int ready;
  printf("ready0 at %p, ready at %p. \n", (void*)&ready0, (void*)&ready); 
} 

I think that since the program only deals with virtual memory, it should seem to the program that it is the only process running on the machine. I also looked at the disassembled code, which looks very deterministic. Thus, if I run the program for many times, the result should be identical. However, experiments show that this is not the case. Why do the experiments differ from what I expected? What caused the results to differ each time I run the program?

If you're interested, here's several experiment results on Mac OS X Yosemite.

$ ./sp
ready0 at 0x102b18018, ready at 0x7fff5d0e876c. 
$ ./sp
ready0 at 0x107c09018, ready at 0x7fff57ff776c. 
$ ./sp
ready0 at 0x10aa9c018, ready at 0x7fff5516476c. 
$ ./sp
ready0 at 0x10d56d018, ready at 0x7fff5269376c. 
$ ./sp
ready0 at 0x10da1c018, ready at 0x7fff521e476c. 
$ ./sp
ready0 at 0x109aff018, ready at 0x7fff5610176c. 
$ ./sp
ready0 at 0x107c31018, ready at 0x7fff57fcf76c. 
$ ./sp
ready0 at 0x10fab1018, ready at 0x7fff5014f76c. 

Answer 1

In the old days you would usually have been right; the stack pointer at entry to main would often have been the same (but it also depends upon your environment, see environ(7) ...). Details are given (for Linux notably) in your ABI spec & in execve(2) syscall. Your (and mine) ABI is often AMD64 ABI .

Current systems have, for security purposes, ASLR - address space layout randomization - (which you could disable system-wide with echo 0 > /proc/sys/kernel/randomize_va_space to be run as root; this opens a security hole) . So the stack pointer at entry to main is a bit random.

^{Hint: you might want to disable ASLR if you use gdb watchpoints.}

Answer 2

It's due to address space layout randomization.

From Wiki:

*

Address space layout randomization (ASLR) is a computer security method which involves randomly arranging the positions of key data areas, usually including the base of the executable and position of libraries, heap, and stack, in a process's address space.

Benefits

Address space randomization hinders some types of security attacks by making it more difficult for an attacker to predict target addresses. For example, attackers trying to execute return-to-libc attacks must locate the code to be executed, while other attackers trying to execute shellcode injected on the stack have to find the stack first. In both cases, the related memory addresses are obscured from the attackers. These values have to be guessed, and a mistaken guess is not usually recoverable due to the application crashing.

*