ToDo:
NX bit ¤È¤¤¤¦¤Î¤òΩ¤Æ¤Æ¤¦¤ó¤Ì¤ó¤È¤¤¤¦¤ä¤Ä¤Ï exec-shield ¤È¤ÏÈù̯¤Ë°ã¤¦¤é¤·¤¤¡Ä¤È¤¤¤¦¤Î¤Ï¤À¤¤¤ÖÁ°¤É¤³¤«¤ÇÆɤó¤À¤è¤¦¤Êµ¤¤¬¤¹¤ë¤±¤É¤Ê¤ó¤«¤Þ¤¡ÃΤé¤ó¡£¤È¤Ë¤«¤¯ Windows ¤Ç¤Ï DEP ¤È¤¤¤¦¤é¤·¤¤¡£
¤Ç¤Þ¤¡¡¢·ë¶É¡¢¥¹¥¿¥Ã¥¯½ñ¤ÊѤ¨¤Æ¥ì¥¸¥¹¥¿¤âŬÅö¤Ë¥»¥Ã¥È¤·¤Æ½àÈ÷¤¬¤½¤í¤Ã¤¿Ãʳ¬¤Ç mprotect ¤Ë ret ¤ÇÈô¤ó¤Ç¤¯¡¢¤Ã¤Æ¤¤¤¦¤Î¤¬´ðËÜŪ¤ÊÏä餷¤¤¡£ return to libc ¤È¤¤¤¦Ã±¸ì¤Ïʹ¤¤¤¿¤³¤È¤Ï¤¢¤Ã¤¿¤ó¤À¤±¤É¡¢ libc ¤ËÈô¤ó¤Ç¤¯¤Ã¤Ä¤Æ¤â¤É¤Î´Ø¿ô¤ËÈô¤ó¤Ç¤¯¤ó¤À¤í¤¦¤É¤¦¤»¤¿¤¤¤·¤¿°ú¿ô½àÈ÷¤Ç¤¤Ê¤¤¤À¤í¤¦¤·¡Ä¤È¤«»×¤Ã¤Æ¤¤¤¿¡£ mprotect ¤ËÈô¤ó¤Ç¤¯¤Ê¤éǼÆÀ¤À¤Ê¡¼¤È»×¤Ã¤¿¡£
address randomization ¤Ê¤ó¤Æ¤Î¤Ï¤Ê¤ó¤«¶Ú¤¬°¤½¤¦¤À¤È¤Ê¤ó¤È¤Ê¤¯»×¤Ã¤Æ¤¤¤Æ¡¢¤¤¤äŬÅö¤Ê fix ¤È¤·¤Æ¤Ï¤¤¤¤¤È»×¤¦¤ó¤À¤±¤É¡¢¤Þ¤¡¤È¤ê¤¢¤¨¤º mprotect ¤·¤Ê¤¯¤Æ¤¤¤¤¥×¥í¥°¥é¥à¤Ï¡¢¤³¤Î¥×¥í¥°¥é¥à¤ÏÀäÂÐ mprotect ¸Æ¤Ó¤Þ¤»¤ó¤è¡¼¤ÈÀë¸À¤¹¤ì¤Ð mprotect ÀäÂФ˸Ƥ٤ʤ¤¤è¤¦¤Ë¤¹¤ë¤È¤¤¤¤¤ó¤¸¤ã¤Ê¤¤¤«¤Ê¤¡¤È¤«¡¢¤¢¤È¤½¤³¤Þ¤Ç¹Ô¤«¤Ê¤¯¤Æ¤â writable ¤«¤Ä executable ¤Ê mprotect ¤Ï¶Ø»ß¡¼¤È¤«¤¹¤ì¤Ð¤½¤ì¤Ê¤ê¤Ë¤Ê¤ó¤È¤«¤Ê¤ë¤Î¤«¤Ê¤¡¤È¤«»×¤Ã¤¿¤ê¤·¤¿¡£
(01:27)
VMX ¤Ã¤Æ¶ñÂÎŪ¤Ë¤É¤¦¤¤¤¦Ì¿ÎáÁý¤¨¤¿¤«¤È¤«Ä´¤Ù¤ë¤Ù¤¡£ ÆÃ¤Ë vmcall ¤Ã¤Æ¤É¤¦¼õ¤±¤ë¤Î¤«¤Ê¡¼¤È¤«¡£
¤¢¤È lua ¤Î tailcall ¤¬ jmp ¤¸¤ã¤Ê¤¤Íýͳ¡£ ¥³¡¼¥É¸«¤ë¤È¤Ê¤ó¤«°ì¸«¤À¤¤¤Ö°ã¤¦¤Ê¡¼
¤¢¤È lua ¤Î closure ¤¦¤ó¤Ì¤ó¤ÏÊÌ¤Ë¤Ê¤ó¤« ¤½¤Î¤Þ¤ó¤Þ¤Êµ¤¤¬¤·¤¿¤±¤É¤¿¤·¤«¤Ë ¥ì¥¸¥¹¥¿¥Ù¡¼¥¹¤À¤È¥¹¥¿¥Ã¥¯ÊÝ»ý¤·¤È¤¯¤Ã¤Æ¤ï¤±¤Ç¤â¤Ê¤¤¤ï¤±¤Ç ¤É¤ó¤Ê´¶¤¸¤Ë¤Ê¤Ã¤Æ¤ë¤Î¤«¤Ê¤È¾¯¤·¹Í¤¨¤ë¤È¤¤¤¦¤«Æɤफ
(01:32)
id:firewood ¤µ¤ó¤Ë Windows ¤Ç¤ÎÀ¸³è¤Ë¤Ä¤¤¤Æ¤È¤«¤ò¤ªÊ¹¤¤¹¤ë¡£
¤Ê¤ó¤« Windows ¤Ë¤Ä¤¤¤Æ¤Ï¤È¤ê¤¢¤¨¤º µ¿Ìä¤ò¤Þ¤È¤á¤Æ¤ª¤¯É¬Íפ¬¤¢¤ë¤è¤¦¤Êµ¤¤¬¤·¤¿¡£
¤¢¤È Linux »È¤Ã¤Æ¤ë»þ¤â¡¢ ÉÔÊؤ˴¶¤¸¤ë¤È¤³¤í¤ò¤É¤¦Âн褷¤¿¤«¡¢ ¤È¤«¥á¥â¤Ã¤Æ¤¤¤¯¤È Windows ¤ÇƱ¤¸¤³¤È¤¹¤ë»þ¤É¤¦¤¹¤ë¤«¡¢ ¤ß¤¿¤¤¤Êµ¿Ìä¤ò¸å¤Ç°ì¤Ä°ì¤Ä¥µ¥Ð¤¤¤Æ¤¤¤±¤¿¤ê¤¹¤ë¤«¤Ê¤¡¡£
¤¢¤È CUI ¤À¤È¤Ê¤ó¤«¤Á¤ç¤Ã¤È¤·¤¿¥ß¥¹¤ÇÃ×̿Ū¤Ê¤³¤È¤¬µ¯¤¤¿¤ê¤È¤«¡¢ ºÙ¤«¤¤¥ª¥×¥·¥ç¥ó¤È¤«Ä´¤Ù¤ë¤Î¤¬¤À¤ë¤¤¤È¤«¡¢¤½¤¦¤¤¤¦»ØŦ¤Ï¤â¤Ã¤È¤â¤À¤È»×¤¦¡£ ¤È¤ê¤¢¤¨¤ºº£ÅÙ man ¤È¤« --help ¤ÎÍúÎò¤ò¸«¤Æ¤ß¤ë¤ÈÌÌÇò¤¤¤«¤Ê¡£
(01:36)
2008ǯ¤Ï813²ó¡¢2009ǯ¤Ï374²ó¡£ÂçÉý¤Ë¸º¤Ã¤Æ¤ë¤Ê¡Ä
2008ǯ¤Ë¤è¤¯Ä´¤Ù¤¿ man
8 diff 8 dosemu 8 getpid 8 gettimeofday 8 mprotect 9 backtrace 9 ld 9 signal 10 memset 10 objdump 10 printf 10 select 10 write 19 clock
¤Ê¤ó¤Ç clock ¤½¤ó¤Ê¤Ë¿¤¤¤ó¤À¡Ä write ¤È¤« memset ¤Ï¤É¤¦¤»°ú¿ô½ç¡¢ select ¤È¤« printf ¤Ï¤¿¤·¤«¤ËÄ´¤Ù¤Æ¤½¤¦¡£
2009ǯ
5 fgets 5 memcpy 5 write 6 fread 6 getpriority 6 mount 6 setpgid 7 atoi 7 printf 8 memset 10 connect
¤¦¡¼¤ó¤Ê¤ó¤À¤í¤¦¤Ê¡£ ÌÀ¤é¤«¤Ë¥´¥ë¥Õ¾ì¤Ç¤·¤ç¤¦¤Í¡¢¤È¤¤¤¦¤â¤Î¤â¿¤¤¤±¤É¡¢ ¤¦¡¼¤ó connect?
¤¢¤È info ¤Ï¤É¤Ã¤Á¤âÅöÁ³ gcc ¤¬2ǯ¤Ç57²ó¤Ç°µ¾¡¡¢2°Ì¤¬ sed ¤Î 10 ²ó¡£ ¤¢¤¿¤ê¤Þ¤¨¤È¤¤¤¨¤Þ¤¹
(01:47)
¤¿¤Ö¤ó man clock ¤Ç hwclock ¤È¤«¤¤¤¦¤Î¤¬ ½Ð¤Æ¤¯¤ë¤«¤é man 3 clock ¤È¤ä¤ê¤Ê¤ª¤¹ÅÀ¤È¡¢ ¤¢¤È CLOCKS_PER_SEC ¤ò˺¤ì¤ë¤«¤é¤À¤È¤¤¤¦Í½ÁÛ¤¬À®Î©¤·¤¿
(01:50)
Á° | 2010ǯ 2·î |
¼¡ | ||||
Æü | ·î | ²Ð | ¿å | ÌÚ | ¶â | ÅÚ |
1 | 2 | 3 | 4 | 5 | 6 | |
7 | 8 | 9 | 10 | 11 | 12 | 13 |
14 | 15 | 16 | 17 | 18 | 19 | 20 |
21 | 22 | 23 | 24 | 25 | 26 | 27 |
28 |
Á´¤Æ¥ê¥ó¥¯¥Õ¥ê¡¼¤Ç¤¹¡£ ¥³¡¼¥ÉÊҤϼ«Í³¤Ë»ÈÍѤ·¤Æ¤¤¤¿¤À¤¤¤Æ¹½¤¤¤Þ¤»¤ó¡£ ¤½¤Î¾¤Î¤â¤Î¤ÏGPL°·¤¤¤Ç¤¢¤ì¤Ð¤¢¤é¤æ¤ë»ÈÍѤ˴ؤ·¤Æʸ¶ç¤Ï¸À¤¤¤Þ¤»¤ó¡£ ¤Ê¤Ë¤«¤¢¤ì¤Ð²¼µ¥á¡¼¥ë¥¢¥É¥ì¥¹¤Ø¡£