3 ms·

I don't suppose modern os would let you do that today, sounds like a security nightmare

by jokoon 2y ago

shortrounddev2 2y ago
This is just JIT'ing. It's used in python and lua commonly
- pjmlp 2y ago
  I wish, JIT and Python still isn't something to brag about.
  - greenavocado 2y ago
    Python 3.13 has an experimental JIT compiler https://peps.python.org/pep-0744/ https://peps.python.org/pep-0744/
    - pjmlp 2y ago
      As I said, not something to brag about.
- HelloNurse 2y ago
  It's just loading a dynamic library from an arbitrary file, as traditionally done for third party software addons (e.g. Photoshop plugins since the early 1990s and VST instruments and effects since the late 1990s).
fluoridation 2y ago
Yes, any modern OS lets any process load into its memory space binaries from anywhere the user has permissions, even if those are binaries it generated just now. It can be a security problem if the binaries are generated from untrusted sources (e.g. you download some, say, Haskell, compile it and run it fully automatically).
- shortrounddev2 2y ago
  Windows has a private heap system where you can disable code execution from the pages allocated to `HeapCreate`, if you don't* set that flag: https://learn.microsoft.com/en-us/windows/win32/api/heapapi/nf-heapapi-heapcreate https://learn.microsoft.com/en-us/windows/win32/api/heapapi/... > HEAP_CREATE_ENABLE_EXECUTE > 0x00040000 > All memory blocks that are allocated from this heap allow code execution, if the hardware enforces data execution prevention. Use this flag heap in applications that run code from the heap. If HEAP_CREATE_ENABLE_EXECUTE is not specified and an application attempts to run code from a protected page, the application receives an exception with the status code STATUS_ACCESS_VIOLATION. I think POSIX has equivalent memory protection calls, but no equivalent to HeapCreate
  - fluoridation 2y ago
    But you can still call VirtualAlloc(), VirtualProtect(), and LoadLibrary(), so this isn't really a security mechanism, but more of a safety mechanism. I don't think Windows provides a mechanism to disable creating any further executable pages, although I've seen Chrome do it by hooking those functions (and I know it because I've had to bypass it :)).
    - pjmlp 2y ago
      App Sandboxing and VBS enclaves go onto that direction.
    - shortrounddev2 2y ago
      I wouldn't expect windows to prevent creating further executable pages; there are legitimate use cases for creating dynamically allocated executable memory. It just means that whatever foreign data you load into those pages can't execute, which is a security mechanism (for example, game save data can be loaded into these heaps so that you can load all game state but without the save file potentially running foreign code)
      - fluoridation 2y ago

I don't suppose modern os would let you do that today, sounds like a security nightmare

by jokoon 2y ago

I don't suppose modern os would let you do that today, sounds like a security nightmare

shortrounddev2 2y ago

This is just JIT'ing. It's used in python and lua commonly

pjmlp 2y ago
I wish, JIT and Python still isn't something to brag about.
- greenavocado 2y ago
  Python 3.13 has an experimental JIT compiler https://peps.python.org/pep-0744/ https://peps.python.org/pep-0744/
  - pjmlp 2y ago
    As I said, not something to brag about.
HelloNurse 2y ago
It's just loading a dynamic library from an arbitrary file, as traditionally done for third party software addons (e.g. Photoshop plugins since the early 1990s and VST instruments and effects since the late 1990s).

fluoridation 2y ago

Yes, any modern OS lets any process load into its memory space binaries from anywhere the user has permissions, even if those are binaries it generated just now. It can be a security problem if the binaries are generated from untrusted sources (e.g. you download some, say, Haskell, compile it and run it fully automatically).

shortrounddev2 2y ago
Windows has a private heap system where you can disable code execution from the pages allocated to `HeapCreate`, if you don't* set that flag: https://learn.microsoft.com/en-us/windows/win32/api/heapapi/nf-heapapi-heapcreate https://learn.microsoft.com/en-us/windows/win32/api/heapapi/... > HEAP_CREATE_ENABLE_EXECUTE > 0x00040000 > All memory blocks that are allocated from this heap allow code execution, if the hardware enforces data execution prevention. Use this flag heap in applications that run code from the heap. If HEAP_CREATE_ENABLE_EXECUTE is not specified and an application attempts to run code from a protected page, the application receives an exception with the status code STATUS_ACCESS_VIOLATION. I think POSIX has equivalent memory protection calls, but no equivalent to HeapCreate
- fluoridation 2y ago
  But you can still call VirtualAlloc(), VirtualProtect(), and LoadLibrary(), so this isn't really a security mechanism, but more of a safety mechanism. I don't think Windows provides a mechanism to disable creating any further executable pages, although I've seen Chrome do it by hooking those functions (and I know it because I've had to bypass it :)).
  - pjmlp 2y ago
    App Sandboxing and VBS enclaves go onto that direction.
  - shortrounddev2 2y ago
    I wouldn't expect windows to prevent creating further executable pages; there are legitimate use cases for creating dynamically allocated executable memory. It just means that whatever foreign data you load into those pages can't execute, which is a security mechanism (for example, game save data can be loaded into these heaps so that you can load all game state but without the save file potentially running foreign code)
    - fluoridation 2y ago