3 ms·

To prevent JIT Spraying, simply avoid EXecute-Write programs/applicatioms: - Just-In-Time Compiler - - JavaScript, in certain mode - - .NET (Microsoft C# com

To prevent JIT Spraying, simply avoid EXecute-Write programs/applicatioms: - Just-In-Time Compiler - - JavaScript, in certain mode - - .NET (Microsoft C# compiler) - - Java Virtual Machine (JVM) - - Adobe ActionScript (embedded JavaScript) - Berkeley Packet Filter (Linux) API - Adobe Actionscript (Adobe Flash) As a security architect, you should be extremely mindful of the immense baggage that JIT design comes with. References - https://en.wikipedia.org/wiki/JIT_spraying https://en.wikipedia.org/wiki/JIT_spraying - https://en.wikipedia.org/wiki/W%5EX https://en.wikipedia.org/wiki/W%5EX

sanxiyn 5y ago
Note that .NET 6 can use W^X now (and use it by default on ARM macOS). I agree W^X is an important security feature every JIT should support (V8, I am looking at you. Google, what's so difficult about this?).
saagarjha 5y ago
I’m confused what JIT spraying has to do with this post?
- egberts1 5y ago
  if an app can allow WX memory segment (like Zoom), then JIT spray can then be able to occur.
  - saagarjha 5y ago
    Ok, but where is Zoom using a JIT?
    - egberts1 5y ago
      via C# and .NET
    - egberts1 5y ago
      there ye go… https://write.as/n5r0vjolumdnuk2k.md https://write.as/n5r0vjolumdnuk2k.md