GNU工具链里的漏洞利用缓解技术樊付强.pdf

A travel through exploit mitigations in GNU toolchains 樊付强 腾御安基础信息安全咨询 #ls -l  00 whoami  01 GCC/ld/Glibc­dlinternals  0100 GCC internals  0101 ld internals  0102 Glibc­dl internals  02 smashing the stack  03 implementation of classical mitigations  0300 stack canary  0301 NX(No­eXecutable)  0302 PIC/PIE  ASLR  0303 relro  04 return­oriented programming  05 CFI  implementation in GCC  06 intro to RAP of PaX/Grsecurity [00] whoami  coder whole my life  worked on SDCC/gputils, GCC/binutils, LLVM  security engineer member of hardenedlinux/h4rdenedzer0  write a C89 compiler from scratch only for fun(2009­2012) [01] GCC/ld/Glibc dynamic-linker internals  0100 GCC internals  0101 ld internals  0102 Glibc­dl internals [0100] GCC internals/source directory overview zet@fuck-GFW ~/dust/gcc/gcc-6.2.0 $ls -lF ABOUT-NL /* gettext*/ boehm-gc/ /* java gc*/ compile* /* script call gcc by user*/ config/ /* lots of m4 script*/ config.guess* config-ml.in config.rpath* config.sub* configure* configure.ac contrib/ /* download prerequest/generate man pages*/ depcomp* /* call compiler generate dependency*/ fixincludes/ /* fix(macro) system header to work with gcc*/ gnattools/ /* Ada*/ gotools/ /* golang*/ include/ /* getopt.h, sha1.h, etc*/ INSTALL/ /* html install files*/ [0100] GCC internals/source directory overview zet@fuck-GFW ~/dust/gcc/gcc-6.2.0 $ls -lF install-sh* /* called by make install*/ intl/ /* gettext*/ libada/ libatomic/ /* __sync/__atomic*/ libbacktrace/ /* output like gdb backtrace*/ libcc1/ /* gdb evalute code on current context*/ libcilkrts/ /* intel ci