Update README.md

Author: carlospolop

src/binary-exploitation/common-binary-protections-and-bypasses/aslr/README.md

@@ -329,30 +329,31 @@ On many arm64 Android kernels the kernel linear map (direct map) base is fixed a
   - PHYS_OFFSET = memstart_addr (exported symbol)
   - Translation: `virt = ((phys - PHYS_OFFSET) | PAGE_OFFSET)`
 
-Why it’s fixed
-- Limited kernel VA space plus CONFIG_MEMORY_HOTPLUG reserves VA for future hotplug, pushing the linear map to the lowest VA (fixed base).
-- Upstream arm64 removed linear-map randomization (commit `1db780bafa4c`).
-
-Leaking PHYS_OFFSET (rooted or with a kernel read primitive)
+**Leaking PHYS_OFFSET (rooted or with a kernel read primitive)**
 - `grep memstart /proc/kallsyms` to find `memstart_addr`
 - Read 8 bytes at that address (LE) using any kernel read (e.g., tracing-BPF helper calling `BPF_FUNC_probe_read_kernel`)
 - Compute direct-map VAs: `virt = ((phys - PHYS_OFFSET) | 0xffffff8000000000)`
 
-Exploitation impact
+**Exploitation impact**
 - No separate KASLR leak needed if the target is in/reachable via the direct map (e.g., page tables, kernel objects on physical pages you can influence/observe).
 - Simplifies reliable arbitrary R/W and targeting of kernel data on arm64 Android.
 
-Reproduction summary
+**Reproduction summary**
 1) `grep memstart /proc/kallsyms` -> address of `memstart_addr`
 2) Kernel read -> decode 8 bytes LE -> `PHYS_OFFSET`
 3) Use `virt = ((phys - PHYS_OFFSET) | PAGE_OFFSET)` with `PAGE_OFFSET=0xffffff8000000000`
 
 > [!NOTE]
 > Access to tracing-BPF helpers requires sufficient privileges; any kernel read primitive or info leak suffices to obtain `PHYS_OFFSET`.
+
+**How it’s fixed**
+- Limited kernel VA space plus CONFIG_MEMORY_HOTPLUG reserves VA for future hotplug, pushing the linear map to the lowest VA (fixed base).
+- Upstream arm64 removed linear-map randomization (commit `1db780bafa4c`).
+- 
 ## References
 
 - [Defeating KASLR by Doing Nothing at All (Project Zero)](https://googleprojectzero.blogspot.com/2025/11/defeating-kaslr-by-doing-nothing-at-all.html)
 - [arm64: remove linear map randomization (commit 1db780bafa4c)](https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/commit/?id=1db780bafa4c)
 - [Tracing BPF arbitrary read helper (Project Zero issue 434208461)](https://project-zero.issues.chromium.org/issues/434208461)
 
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../banners/hacktricks-training.md}}