2 ms·
Scary. I assume standard memory corruption detection tools would also have trouble finding this, as the write is coming from outside the application itself…
by saagarjha 2y ago
Scary. I assume standard memory corruption detection tools would also have trouble finding this, as the write is coming from outside the application itself…
- loeg 2y agoYeah. Not tripping a page fault on modifying readonly (userspace) pages both makes it hard for userspace tools but also paints a pretty specific picture of where the write is coming from. I'm actually not sure if Linux would handle this in the same way or what. Plausibly it sees the same leaf page tables as user space, trips a fault, and doesn't scribble the pages anyway. Maybe Windows translates the user-provided virtual address to a physical address (or other kernel mapping that happens to have write permission) upon registration.