HackerTrans
TopNewTrendsCommentsPastAskShowJobs

fatcunt

no profile record

comments

fatcunt
·vor 2 Jahren·discuss
> I do not know why the JMP is not just a RET, however.

This is caused by the CONFIG_RETHUNK option. In the disassembly from objdump you are seeing the result of RET being replaced with JMP __x86_return_thunk.

https://github.com/torvalds/linux/blob/v6.1/arch/x86/include...

https://github.com/torvalds/linux/blob/v6.1/arch/x86/lib/ret...

> The NOP instructions at the beginning and at the end of the function allow ftrace to insert tracing instructions when needed.

These are from the ASM_CLAC and ASM_STAC macros, which make space for the CLAC and STAC instructions (both of them three bytes in length, same as the number of NOPs) to be filled in at runtime if X86_FEATURE_SMAP is detected.

https://github.com/torvalds/linux/blob/v6.1/arch/x86/include...

https://github.com/torvalds/linux/blob/v6.1/arch/x86/include...

https://github.com/torvalds/linux/blob/v6.1/arch/x86/kernel/...
fatcunt
·vor 2 Jahren·discuss
Microsoft has, or had, a similar technology they use internally, called TKO: https://www.microsoft.com/security/blog/2020/05/04/mitigatin...

It's written in Rust and is based around a version of Bochs modified for deterministic execution. It's got time-travel debugging (with WinDbg), which works by replaying forward from the nearest snapshot to the point at which the user is asking to move backwards to.

The primary author of this software wanted to open source it, but the higher-ups at MSFT refused. He's been working on similar projects in a personal capacity though, e.g. https://gamozolabs.github.io/fuzzing/2020/12/06/fuzzos.html