mitigating-code-reuse-attacks.md (949B)
1 +++ 2 title = 'Mitigating code-reuse attacks at the binary level' 3 +++ 4 5 # Mitigating code-reuse attacks at the binary level 6 Control-flow integrity: 7 - promising way to stop code-reuse attacks (using already existing code to do what you want) 8 - hard to enforce in practice 9 - existing binary-level CFI can't prevent function-reuse attacks 10 11 A call to function pointer gives you an attacker-controlled gadget, especially if it's in a loop. 12 - source-level CFI: enforce class hierarchy, match function argument types 13 - TypeArmor for approximate source-level accuracy 14 15 The idea of TypeArmor: 16 - function signature matching: extract argument count at callsite, argument usage at callee. then only allow targets with matching function types 17 - in a callee, argument registers being used before they are written 18 - in a callsite, see which argument registers are set: on function entry point continue, on return edge stop 19 - at runtime, check the number of arguments