RolfRolles

7 ms·

1.
by RolfRolles 2y ago
No, it's really not a strict improvement. A meaningless name like `v2` does at least convey that you, as the analyst, haven't understood the role of the variable well enough to rename it to something more fitting to its inferred p
2.
by RolfRolles 9y ago
Yes, gadgets arising from non-epilogue instances of C2/C3 are used frequently. In fact they are most often critical and the ROP exploit would not work without them.
3.
by RolfRolles 9y ago
As I said to the other user who replied to a similar comment, these observations apply only to exploitation of stack buffer overflows, and hence don't rebut what I've said about this not mitigating ROP as a general technique (whic
4.
by RolfRolles 9y ago
Your comments only apply to exploitation of stack buffer overflows, which have largely been rendered extinct due to compiler-based strategies like this one. Exploiting, say, a use-after-free vulnerability still may require ROP but does not
5.
by RolfRolles 9y ago
I also must be missing something. XORing the return address on the stack with the stack pointer is similar to other stack protection mechanisms. I forget the precise name of it, but I'm pretty sure one of the existing stack protection
6.
by RolfRolles 12y ago
I think some timing attacks could be reasoned about in a formal context. You could model the timing details of a given CPU and then prove that two assembly language functions were indistinguishable with respect to that model. (For example
7.
by RolfRolles 13y ago
In 2007 I started researching program analysis on my own. I noticed that a lot of freely-available source code was written in OCaml. Then I was supposed to get involved with an academic internship in 2008, where the code was being written
8.
by RolfRolles 13y ago
I've tried literally about a dozen times at this point. Only once did I get some sort of response from the server; now clicking "place order" simply does nothing. Too bad; they got all of this publicity at the expense of th
9.
by RolfRolles 13y ago
Unfortunately, the site does not behave gracefully under heavy traffic. Berkeley resident here, tried to order one of each, but the "place order" page just times out and I am not sure if my order was actually placed, or if I shou
10.
by RolfRolles 15y ago
Being a reverse engineer who knows what symbolic execution is, is a lonely occupation :( http://www.openrce.org/blog/view/2049/[video]_Semi-Automated...
11.
Semi-automated key generator generation, with video(openrce.org)
2 points by RolfRolles 15y ago|0 comments
12.
Finding Bugs in VMs with a Theorem Prover(openrce.org)
2 points by RolfRolles 15y ago|0 comments