3 ms·
That's right. But it's more difficult to exploit, because you have to smash the caller's return address, not your own, and then wait for the caller to return. A
by millstone 12y ago
That's right. But it's more difficult to exploit, because you have to smash the caller's return address, not your own, and then wait for the caller to return. Anyways, my point is merely that if you wanted to design an ISA that maximizes exploitability of buffer overflows, you'd be hard pressed to do better than x86.
- WallWextra 12y agoSometimes I wonder how much better off we'd be with something exactly like x86, but with a stack that grows upwards.
- munin 12y agonot much, wouldn't matter. what you REALLY should wonder is, something like x86, but with code pointers stored in a separate address space.
- ANTSANTS 12y agoWe kinda already had this with the old segmented memory model. That AMD mostly dropped support for it in x86_64 should tell you something. https://en.wikipedia.org/wiki/X86_memory_segmentation https://en.wikipedia.org/wiki/X86_memory_segmentation
- Scaevolus 12y agoA stack that grows upwards means that you exploit the return address of called functions instead of your current function. void dangerous() { char buf[10]; gets(buf); // the return in gets could be redirected }
- SamReidHughes 12y agoIf the buffer is on the stack and being overflowed by the function that declared it, not some callee.