W^X Transition (6 of 6): Without per-page X A simpler view... In each object the "data" section starts 512MB after the "code" section. Kernel loads main program and ld.so into memory ld.so packs objects like libc into the address space, making them fit "overlapping the gaps" Insane but effective.