instead of separating the code from the data, another mitigation technique is to introduce randomization to the memory space of the executing program. since the attacker needs to determine where executable code that can be used resides, either an executable payload is provided (with an executable stack) or one is constructed using code reuse such as in ret2libc or return-oriented programming (rop). randomizing the memory layout will, as a concept, prevent the attacker from knowing where any code is. however, implementations typically will not randomize everything; usually the executable itself is loaded at a fixed address and hence even when aslr (address space layout randomization) is combined with a nonexecutable stack the attacker can use this fixed region of memory. therefore, all programs should be compiled with pie (position-independent executables) such that even this region of memory is randomized. the entropy of the randomization is different from implementation to implementation and a low enough entropy can in itself be a problem in terms of brute forcing the memory space that is randomized.