A forensic analyst suspects that a buffer overflow exists in a kernel module. The analyst executes the following command

[answerhappygod]

A forensic analyst suspects that a buffer overflow exists in a kernel module. The analyst executes the following command:

However, the analyst is unable to find any evidence of the running shell.
Which of the following of the MOST likely reason the analyst cannot find a process ID for the shell?

A Forensic Anal 1 (14.4 KiB) Viewed 61 times

A. The NX bit is enabled
B. The system uses ASLR
C. The shell is obfuscated
D. The code uses dynamic libraries