selfrando icon indicating copy to clipboard operation
selfrando copied to clipboard

Add guard pages between randomized functions in selfrando

Open ahomescu opened this issue 6 years ago • 0 comments

Code pages containing functions are vulnerable to information leaks even under selfrando. One simple way to bypass selfrando's randomization is to locate all program code pages and scan them linearly to look for gadgets. A simple mitigation for this particular attack is to randomly insert guard pages (unmapped empty pages in the address space) between the shuffled functions, so the linear scan algorithm crashes when attempting to read our randomized code.

ahomescu avatar Oct 02 '18 21:10 ahomescu