The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)
The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)
复制标题
DOI：
10.1145/1315245.1315313
复制
发表时间：
2007-10
期刊：
影响因子：
--
通讯作者：
H. Shacham
中科院分区：
文献类型：
--
作者：
H. Shacham
我们提出了新技术，该技术允许将返回的libc攻击安装在X86可执行文件上，该攻击根本没有函数。我们的攻击结合了大量简短的指令序列，以构建允许任意计算的小工具。我们展示了如何通过静态分析发现此类指令序列。我们以必不可少的方式使用X86指令集的属性。
We present new techniques that allow a return-into-libc attack to be mounted on x86 executables that calls no functions at all. Our attack combines a large number of short instruction sequences to build gadgets that allow arbitrary computation. We show how to discover such instruction sequences by means of static analysis. We make use, in an essential way, of the properties of the x86 instruction set.