4 ms·
I know nothing of the implementation, but hypothetically a compiler could translate: p++ to instructions that effectively do: p = enc(dec(p)+1) With
by joshka 6y ago
I know nothing of the implementation, but hypothetically a compiler could translate:
p++
to instructions that effectively do:
p = enc(dec(p)+1)
Without exposing p outside the CPU. The implementation described (seems to be) new instructions for incrementing and dereferencing pointers.
- bawolff 6y agoIn which case, can't you just use it in your shell code? I guess the defense is info leaks are useless so you can't defeat aslr(?)
- joshka 6y ago(that should have read without disclosing dec(p)) But yeah, you'd have to end up with equivalents to p* = 123 which becomes (dec(p)* = 123 etc. My guess is that due to the simon cipher they're allocating full blocks whenever you do the safe version of malloc, and then do a range check to ensure that there is no overrun when storing / incrementing etc.