From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 9815 invoked by alias); 15 Nov 2009 22:36:48 -0000 Received: (qmail 9805 invoked by uid 22791); 15 Nov 2009 22:36:46 -0000 X-SWARE-Spam-Status: No, hits=-2.5 required=5.0 tests=AWL,BAYES_00 X-Spam-Check-By: sourceware.org Received: from NaN.false.org (HELO nan.false.org) (208.75.86.248) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Sun, 15 Nov 2009 22:35:42 +0000 Received: from nan.false.org (localhost [127.0.0.1]) by nan.false.org (Postfix) with ESMTP id A9F3E10EAA; Sun, 15 Nov 2009 22:35:40 +0000 (GMT) Received: from caradoc.them.org (209.195.188.212.nauticom.net [209.195.188.212]) by nan.false.org (Postfix) with ESMTP id 5806110EA3; Sun, 15 Nov 2009 22:35:40 +0000 (GMT) Received: from drow by caradoc.them.org with local (Exim 4.69) (envelope-from ) id 1N9nh5-0006DQ-65; Sun, 15 Nov 2009 17:35:39 -0500 Date: Sun, 15 Nov 2009 22:36:00 -0000 From: Daniel Jacobowitz To: Paul Pluzhnikov Cc: gdb-patches@sourceware.org, Pedro Alves , Ulrich Weigand Subject: Re: RFC: Longjmp vs LD_POINTER_GUARD revisited Message-ID: <20091115223539.GA23336@caradoc.them.org> Mail-Followup-To: Paul Pluzhnikov , gdb-patches@sourceware.org, Pedro Alves , Ulrich Weigand References: <20091115173429.GB23483@caradoc.them.org> <8ac60eac0911151029i60ae1713m8ee2de5c05103d9d@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <8ac60eac0911151029i60ae1713m8ee2de5c05103d9d@mail.gmail.com> User-Agent: Mutt/1.5.20 (2009-06-14) X-IsSubscribed: yes Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org X-SW-Source: 2009-11/txt/msg00345.txt.bz2 On Sun, Nov 15, 2009 at 10:29:33AM -0800, Paul Pluzhnikov wrote: > On Sun, Nov 15, 2009 at 9:34 AM, Daniel Jacobowitz wrote: > > > * Where the jmp_buf contents are obfuscated, as done by glibc, which > > "encrypts" them using a canary stored in the thread TCB. > > FWIW, I never understood the point of this obfuscation: the program > (and any rogue code injected into it) can trivially discover the value > of canary: > > call sigsetjmp > a_label: > ... canary = sigjmp_buf.__jmpbuf[JB_PC] - &a_label > > I think GDB could also perform such discovery, and that would allow it > work with non-debug glibc (debug glibc (I believe) is exception rather > the rule outside of {gdb,glibc,gcc} developers). There's a rotate and an xor involved; I don't believe this would work as written... sure, we could "discover" it from disassembling key functions automatically... -- Daniel Jacobowitz CodeSourcery