3 ms·
How do W^X restrictions affect something like this? I assume there must be a way to work around it given the prolificacy of JITing VMs, but interested in the d
by udp 9y ago
How do W^X restrictions affect something like this? I assume there must be a way to work around it given the prolificacy of JITing VMs, but interested in the details. The last time I was fiddling with machine code in memory was before W^X was a thing.
- skissane 9y agoUse mprotect to change the access protection flags on a page of memory. Assuming it is initially allocated as write but no execute (PROT_READ|PROT_WRITE), write your machine code to it, then change it to read-only and execute (PROT_READ|PROT_EXEC). http://man7.org/linux/man-pages/man2/mprotect.2.html http://man7.org/linux/man-pages/man2/mprotect.2.html mprotect is part of POSIX, so works on Linux, macOS, etc. The Windows equivalent is VirtualProtect https://msdn.microsoft.com/en-us/library/windows/desktop/aa366898(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa3...
- jheriko 9y agoAnnoyingly this doesn't apply on the most modern platforms... see windows phone/universal etc as well as mobile platforms, consoles and all sorts of embedded systems. (ps I did a significant chunk of this for https://code.google.com/archive/p/fridgescript/ https://code.google.com/archive/p/fridgescript/ back when this made real sense, I'm not just making hot air... this is quite a mediocre result imo ... bedroom stuff from years ago..,)
- my123 9y agoThere are AsApp variants on UWP, if you claim the JIT permission.
- cstrahan 9y agoI've written a demonstration of this sort of thing in Ruby, where I scribble a cdecl function to memory and execute it, with the end goal being: invoke the cpuid instruction to get info about the processor. http://www.cstrahan.com/posts/2013-07-15-pure-ruby-cpuid-via-ffi.html http://www.cstrahan.com/posts/2013-07-15-pure-ruby-cpuid-via...