3 ms·
> proxying system calls Locally calculating what needs to be on the remote stack then transferring it all across the network to a tiny 'syscall server' is very
by brl 18y ago
> proxying system calls
Locally calculating what needs to be on the remote stack then transferring it all across the network to a tiny 'syscall server' is very nice conceptually but turns out to have huge flaws in practice.
The commercial implementation of this idea which you might be thinking of was completely replaced years ago by an executable that still executes individual system calls, but it accepts an XDR marshalled RPC protocol instead of raw bytes to place on the stack.
This executable is statically compiled (well it has no library dependencies to begin with) and installed into memory with a very crude implementation of userland exec :)
- tptacek 18y agoMosdef was never just raw system call stack frames, but if you ask me about commercial syscall proxies, I don't think of CORE Impact; I think about BMC/BladeLogic, which provides a "remoted cygwin"-style interface built on syscall proxying. Again, you're right that just being able to compile and run an oblivious application is nicer than having a good remoting implementation; however, most exploits just use remoting. (I'm actually prepared to concede that this is a big win, since you're closer to shellcode development than I am.)