From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 4134 invoked by alias); 16 Nov 2009 14:37:22 -0000 Received: (qmail 4125 invoked by uid 22791); 16 Nov 2009 14:37:21 -0000 X-SWARE-Spam-Status: No, hits=-2.5 required=5.0 tests=AWL,BAYES_00 X-Spam-Check-By: sourceware.org Received: from NaN.false.org (HELO nan.false.org) (208.75.86.248) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Mon, 16 Nov 2009 14:36:17 +0000 Received: from nan.false.org (localhost [127.0.0.1]) by nan.false.org (Postfix) with ESMTP id 8FDCB10D8B; Mon, 16 Nov 2009 14:36:15 +0000 (GMT) Received: from caradoc.them.org (209.195.188.212.nauticom.net [209.195.188.212]) by nan.false.org (Postfix) with ESMTP id 600CF104AD; Mon, 16 Nov 2009 14:36:15 +0000 (GMT) Received: from drow by caradoc.them.org with local (Exim 4.69) (envelope-from ) id 1NA2gf-0002Xt-AR; Mon, 16 Nov 2009 09:36:13 -0500 Date: Mon, 16 Nov 2009 14:37:00 -0000 From: Daniel Jacobowitz To: Paul Pluzhnikov Cc: gdb-patches@sourceware.org, Pedro Alves , Ulrich Weigand Subject: Re: RFC: Longjmp vs LD_POINTER_GUARD revisited Message-ID: <20091116143613.GA9703@caradoc.them.org> Mail-Followup-To: Paul Pluzhnikov , gdb-patches@sourceware.org, Pedro Alves , Ulrich Weigand References: <20091115173429.GB23483@caradoc.them.org> <8ac60eac0911151029i60ae1713m8ee2de5c05103d9d@mail.gmail.com> <20091115223539.GA23336@caradoc.them.org> <8ac60eac0911151505s6834e781wf6887f0641345db@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <8ac60eac0911151505s6834e781wf6887f0641345db@mail.gmail.com> User-Agent: Mutt/1.5.20 (2009-06-14) X-IsSubscribed: yes Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org X-SW-Source: 2009-11/txt/msg00355.txt.bz2 On Sun, Nov 15, 2009 at 03:05:33PM -0800, Paul Pluzhnikov wrote: > Still it's trivial to discover the canary without disassembling > anything (disassembling requires symbols, which may be stripped): > there are only 3 different algorithms I've seen (no canary, XOR, > XOR+shift-by-9). Hmm, looks like x86_64 has XOR+shift-by-17 now, but > ia64, SPARC and PPC all have just "plain XOR". I don't know about "trivial" - could you explain how you would do this without disassembling? I think that at the least we'd have to call setjmp in the inferior, which has risks with signals / multiple threads / etc. I don't think we call functions in the inferior for discovery otherwise. (Also I'm not entirely comfortable having GDB call functions silently. We do this for malloc, yes - IMO there ought to be an option to turn that off. This is a nasty gotcha that folks using GDB for software forensics may not consider...) IMO the debug info is quite commonly available now, but I wonder what other folks see. Doesn't Red Hat's GDB suggest debuginfo RPMs that you should install? -- Daniel Jacobowitz CodeSourcery