#alsr

Q: I am the lead author of [indistinct], that project started off as a binary rewriter for system libraries. But in libc, there were a lot of dynamic jump instructions that had unpredictable targets, so we had to make it work better. Dynamic jumps that are function pointers, how did you solve the problem of unpredictable targets? A: Good question about dissassembly. We rewrite the target binary and direct transfer targets and function pointers and return addresses. Function pointers/dynamic transfers they are not determined at compile time. In our solution, we don't need to find out which exact jump targets of the core, because we only need to find out possible jump targets, as in, find all code entries and redirect these entries.

Q: It is possible to determine the targets during compile time. But the targets may not need entry points. In the GNU implementation of libc, there are dynamic functions in... Did you apply the solution to low-level library not written in high-level language? A: We can only find all possible code entries, not the entries of functions, but basic blocks. We find these entries through relocation tables in portable executable format

Q: It seems you've protected several DLLs and core executable. Have you tried to protect everything in a real world example? A: In modern systems such as Windows 7, we cannot alter the system kernel modules. So for applications like IE and Firefox, we only replace the related DLL. For simple applications such as [indistinct], we harden all modules of those applications. Q: But even for the browsers, you only did one DLL. Have you tried extending that? A: Because there are many DLLs that we cannot alter.

Q: Catalin. Is control flow hijacking now a solved problem? What's left? What kind of things can you not handle? A: First, when disassembling, there are lots of challenges, especially when the code and data are mixed together, such as the modules in Internet Explorer. Disassembly is prone to errors. Second, our solution uses randomization to protect the binary; in the following paper, we discuss randomization is weak, so it is still possible for the attacker to bypass randomization in some cases.