ASLR is not currently working for the bitcoin-cli.exe binary. This is
due to it not having a .reloc section, which is stripped by default by
the mingw-w64 ld we use for gitian builds. A good summary of issues with
ld and mingw-w64 is available in this thread:
https://sourceware.org/bugzilla/show_bug.cgi?id=19011.
All other Windows binaries that we distribute (bitcoind, bitcoin-qt, bitcoin-wallet, bitcoin-tx and test_bitcoin) do not suffer this issue, and currently having working ASLR. This is due to them exporting (inadvertent or not) libsecp256k1 symbols, and, as a result, the .reloc section is not stripped by ld.
This change is a temporary workaround, also the same one described here: https://www.kb.cert.org/vuls/id/307144/, that causes main() to be exported. Exporting a symbol will mean that the .reloc section is not stripped, and ASLR will function correctly.
Ultimately, this will be fixed by using a newer version of binutils (that has this change). Whether that’s through bumping our gitian distro, or Guix.
Related to #18629, which has a bunch of additional information in the PR description. If you would like to verify whether or not ASLR is indeed working, with or without this change. One easy way to check is using a tool like VMMap.
Here are the memory mappings for the 0.20.0rc1 bitcoind.exe and bitcoin-cli.exe binaries. You’ll notice that over machine restarts, even though the image is marked (ASLR) (which I assume may be due to the header bit being set), no ASLR is actually occuring for bitcoin-cli.exe:
bitcoind.exe
bitcoin-cli.exe
