News for hackers. Stuff that matters.

A comment on Trapsleds. Parent comment

Re:Trapsleds by jstanley on Monday June 26, 2017 @06:26AM (#14635614)
I was under the impression that NOP sleds were inserted by the attacker when they can't quite be sure where exactly their code will begin executing. They just transfer execution to about the region the NOP sled will be, and then slide through to the start of the payload.

Modifying NOP sleds at compile time is not going to defend against this.

[ Parent | on HN ]
Re:Trapsleds by wahern on Wednesday June 28, 2017 @10:01PM (#14660203)
OpenBSD uses W^X aka DEP aggressively. In fact, for OpenBSD 6.1 a program can't even disable W^X unless the binary was mounted on a filesystem with the wxallowed option.

Thus, attackers can't insert NOP sleds. They have to rely on the sleds already in the code. From what I gather from the announcement, toolchains often insert NOPs as padding, inadvertently creating NOP sleds. This is an attempt to fix that.

[ Parent | on HN ]