3 ms·
Have there been any examples of an exploitable crash handler? E.g. a process traps SIGSEGV to print a backtrace upon NULL dereference, and then that signal han
by nitrogen 6y ago
Have there been any examples of an exploitable crash handler? E.g. a process traps SIGSEGV to print a backtrace upon NULL dereference, and then that signal handler is itself somehow exploitable?
- SCHiM 6y agoNot sure on the Linux situation. But this is an established technique on Windows, where stack canaries can be bypassed by overwriting SEH chains (trap handlers) on 32bit windows processes. Which are, strangely enough, recorded as function pointers on the stack. https://www.corelan.be/index.php/2009/07/25/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-3-seh/ https://www.corelan.be/index.php/2009/07/25/writing-buffer-o...
- monocasa 6y agoI've seen some cute work with corrupt DWARF tables (DWARF is internally a Turing complete VM). That work was more focused on hiding computation from virus scanners (so an edited binary), but I wonder if that could be used towards what you're getting at via runtime corruption.