3 ms·
Consider something like this: struct __internal_variable { uint64_t type; void *data; } uint64_t __last_type = [number of buil
by earenndil 9y ago
Consider something like this:
struct __internal_variable {
uint64_t type;
void *data;
}
uint64_t __last_type = [number of builtin types];
whenever you create a new type: increment __last_type and associate that type with the number;
uint64_t typeof(__internal_variable var) {
return var.type;
}
function[__last_type] typechecks;
functions[] = void function(uint64_t type) { failure; }
functions[int] = void function(uint64_t type) { success; }
functions[typeof(myvar)]()
If typeof(myvar) is int, then the function that returns success will be called, otherwise failure, no branches involved! Yes, it's a kludge, but it kind of works.
---
Of course, you don't actually need this trick. If you put enough effort into it, you can essentially compile anything to c, after which you can just compile it with the movfuscator[1]
1: https://github.com/xoreaxeaxeax/movfuscator https://github.com/xoreaxeaxeax/movfuscator
- gpderetta 9y agoThat's basically a jump table. Still vulnerable to spectre (variant 2) without mitigations, btw.
- fpoling 9y agoIt is even worse then switch/match statements. The jump tables can be used to train CPU to jump to a wide variety of addresses than switch/match statements so mounting a speculative execution attack is simpler.
- gpderetta 9y agotrue. Then again switch statements (and I assume match statements in language that have them) are often compiled down to a jump table...