Skip to content

Commit

Permalink
Minor fixes.
Browse files Browse the repository at this point in the history
  • Loading branch information
bluhm committed Sep 14, 2023
1 parent 86eb9a0 commit b0de8f8
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions mitigations-slides.tex
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,7 @@ \subsection{Return Oriented Programming}
\begin{itemize}
\item map stack
\item retguard
\item avoid 0xc3 due to \%rbx
\item fork+exec
\item \texttt{sigreturn(2)} cookie
\item \texttt{setjmp(3)}, \texttt{longjmp(3)} cookie
Expand Down Expand Up @@ -373,8 +374,8 @@ \subsection{fork+exec}
+(0,-0.6) node [draw,minimum width=2cm,fill=red] {stack}
+(0,-4.1) node [draw,minimum width=2cm,fill=yellow] {lib1}
+(0,-5.2) node [draw,minimum width=2cm,fill=magenta] {prog};
\draw [->] (p) to [thick,bend left,edge label={fork(2)}] (f);
\draw [->] (f) to [thick,bend left,edge label={execve(2)}] (e);
\draw [->] (p) to [thick,bend left,edge label={\texttt{fork(2)}}] (f);
\draw [->] (f) to [thick,bend left,edge label={\texttt{execve(2)}}] (e);
\end{tikzpicture}
\end{frame}

Expand Down Expand Up @@ -427,7 +428,7 @@ \subsection{Default and Force}

\subsection{SSH Agent Library Exploit}
\begin{frame}{SSH Agent Library Exploit}
dlopen(3) 4 libraries:
\texttt{dlopen(3)} 4 libraries:
\begin{itemize}
\item ELF header executable stack
\item init signal handler SIGSEGV
Expand All @@ -443,7 +444,7 @@ \subsection{Not yet}
\begin{itemize}
\item ARM pointer authentication
\item shadow stack
\item remove syscall(2)
\item remove \texttt{syscall(2)}
\end{itemize}
\end{frame}

Expand Down

0 comments on commit b0de8f8

Please sign in to comment.