4 ms·
The 'jlp' landing instruction in particular sounds like a sensible addition to the x86 instruction set. While it doesn't solve code injections... limiting the s
by Afforess 9y ago
The 'jlp' landing instruction in particular sounds like a sensible addition to the x86 instruction set. While it doesn't solve code injections... limiting the scope to places where control flow changes intentionally - existing functions on the stack instead of totally arbitrary sections of the stack, will raise an immense barrier to code-reuse attacks. The concept is ridiculously simple - require all jmp instructions 'land' on sanctioned 'jlp' landing pads, and yet this would significantly raise the barrier to building an attack. I love it, and hope it's adopted.
- nickodell 9y agoHow often do the jlp bytes occur randomly in memory? Is this a pattern that never shows up in x86 assembly?
- arnarbi 9y agoYou can create any arbitrary word with an immediate value. E.g. 0: b8 0f 1f 40 bb mov eax,0xbb401f0f Of course, that'd be unlikely to appear at random.
- dTal 9y agoThere is historical precedent - BASIC originally required line numbers for all lines, and GOTO could jump to any of them. Later versions made line numbers optional, so it became a common idiom to only put a line number on a line you needed to jump to. In TI-BASIC this went further - line numbers were dropped entirely and you jumped to "labels", which could be named as well as numbered.
- pvg 9y agoThat's not really the same thing since a big part of the reason BASIC had numbers on every line was to facilitate interactive, line-based editing, not to make them all targets for GOTO. FORTRAN had numerical labels for flow control by that point.