3 ms·
> you can simply JOP to one of the authorized syscall instructions and entirely defeat the mitigation But now you need to know where the libc is mapped in orde
by masklinn 4y ago
> you can simply JOP to one of the authorized syscall instructions and entirely defeat the mitigation
But now you need to know where the libc is mapped in order to find those syscalls instructions yeah? Which increases the complexity of the exploit, because instead of making a syscall you have to find where the libc is mapped, and the entire point of ASLR is making that difficult, no?
- cmeacham98 4y agoThe main binary has to be able to call into libc somehow, and thus it's typically easy to get a libc pointer if you have an existing method of code execution. I don't know how it works on OpenBSD, but on Linux there's a section of memory called the PLT that contains pointers for all the functions from dynamic libraries, including those from libc. Also, there's typically libc pointers all over the stack.
- Sirened 4y agoIf you've managed to map shellcode at all, you necessarily already know where a valid syscall instruction is since otherwise you would not have been able to trigger the mmap syscall to map the shellcode. In any event, mapping shellcode is entirely optional anyways since to even get to that point you must already have full control through ROP, at which point you could do everything the program could (albeit in a significantly more annoying way).