4 ms·
There are ways to compile that elide ROP gadgets. It's easier on architectures like ARM than x86. OpenBSD has taken this approach: Number of ROP gadgets in
by wahern 7y ago
There are ways to compile that elide ROP gadgets. It's easier on architectures like ARM than x86. OpenBSD has taken this approach:
Number of ROP gadgets in 6.3-release arm64 kernel
69935
Number of ROP gadgets in 6.4-beta arm64 kernel
46
https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf
Note: As described later in the presentation, those 46 remaining gadgets are in the boot code, which is erased after booting.
- monocasa 7y agoI'm not convinced that a conditional branch to the ret followed by breakpoints between it and the ret is enough to remove the usefulness of the gadget as much as they say.
- saagarjha 7y agoWhy?
- monocasa 7y agoIt's exactly the kind of roadblock that people who do offensive security are great at finding loopholes around.
- saagarjha 7y agoI mean, that's really been their job every time a new mitigation is developed…the introduction of NX led to the use of ROP, which has been joined by JOP techniques as efforts to remove return gadgets gain momentum.
- monocasa 7y agoThis is more like fitting shellcode into something that can be strcpyed. Not really that much of a complication from an attack perspective.
- saagarjha 7y agoI’m not convinced their search for ROP gadgets in libc is useful; often there’s a “magic” address that will do all the work to directly execve /bin/sh if you jump there (in glibc, this is inside of do_system).