4 ms·
Assuming that baseline protections (ASLR, DEP/Nx etc.) are present, the goal when pruning parts of a binary is probably to reduce the availability of ROP gadget
by m000 2y ago
Assuming that baseline protections (ASLR, DEP/Nx etc.) are present, the goal when pruning parts of a binary is probably to reduce the availability of ROP gadgets [1]. This will make it harder to exploit any remaining bugs in the "useful" code.
OpenBSD appears to be taking a safe/conservative approach based on linking. More aggressive approaches have also been researched, where the pruning is driven by dynamic analysis, and applied using binary rewriting.
[1] https://en.wikipedia.org/wiki/Return-oriented_programming https://en.wikipedia.org/wiki/Return-oriented_programming
- throw0101c 2y ago> More aggressive approaches have also been researched, where the pruning is driven by dynamic analysis, and applied using binary rewriting. Any place(s) one can read more about this research?
- crest 2y agoThis LWN article could be a good starting point: https://lwn.net/Articles/959562/ https://lwn.net/Articles/959562/ The best source for the history of the work are probably the OpenBSD mailing list archives and commit logs, but digging through that is slow and requires context.
- m000 2y agoOff the top of my head I can remember BinREc [1]. I believe I have seen more papers along the same lines, but I can't recall the details. [1] https://bibbase.org/network/publication/kroes-altinay-nash-na-volckaert-bos-franz-giuffrida-binrecattacksurfacereductionthroughdynamicbinaryrecovery-2018 https://bibbase.org/network/publication/kroes-altinay-nash-n...