Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ASLR: PoC for generating random address before Uhyve launches #711

Closed
wants to merge 14 commits into from

Commits on Jun 15, 2024

  1. ASLR: Increase KERNEL_STACK_SIZE to 0x20000

    The previous value, 0x8000, caused problems.
    
    The minimum value required for relocatable images to load (starting from NULL)
    is 0x13000. For additional buffer, the temporary hack here is to increase
    that said value.
    n0toose committed Jun 15, 2024
    Configuration menu
    Copy the full SHA
    f2ccd9f View commit details
    Browse the repository at this point in the history
  2. ASLR: Introduce START_ADDRESS_OFFSET variable

    Will be utilized later.
    n0toose committed Jun 15, 2024
    Configuration menu
    Copy the full SHA
    e44672d View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    f8e99e4 View commit details
    Browse the repository at this point in the history
  4. ASLR: Flesh things out a bit more, add TODOs

    - Introduce end_address_upper_bound.
    - Add mask.
      - Some additional investigation and testing is necessary.
      - Right now, it feels like the mask just works because of a magic
        spell called "Works on my machine.". I didn't get creative with
        the spell name (which does not exist), because I don't know how
        spells sound like. Sorrry.
    - Some architecture-specific work may be needed.
    - Some fine-tuning and debugging information for ASLR is necessary.
    n0toose committed Jun 15, 2024
    Configuration menu
    Copy the full SHA
    fd9a984 View commit details
    Browse the repository at this point in the history
  5. ASLR: Fix mask

    - 0xFFFFF0 cut off the upper 4 bits.
    n0toose committed Jun 15, 2024
    Configuration menu
    Copy the full SHA
    be472f7 View commit details
    Browse the repository at this point in the history
  6. ASLR: Stop using dumb values for the mask

    - Some sleep is required.
    - Some bitwise arithmetic was avoided.
    - Why over-engineer a literal mask value?
    - I should take a break.
    n0toose committed Jun 15, 2024
    Configuration menu
    Copy the full SHA
    705e6e8 View commit details
    Browse the repository at this point in the history
  7. ASLR: cargo fmt run

    n0toose committed Jun 15, 2024
    Configuration menu
    Copy the full SHA
    67528e5 View commit details
    Browse the repository at this point in the history
  8. ASLR: Use proper constant.

    n0toose committed Jun 15, 2024
    Configuration menu
    Copy the full SHA
    842982a View commit details
    Browse the repository at this point in the history

Commits on Jun 16, 2024

  1. ASLR: Distinguish relocatable objects, improve upper bound?

    There is something wrong going on here in this current revision.
    Not sure why.
    n0toose committed Jun 16, 2024
    Configuration menu
    Copy the full SHA
    fe8cefa View commit details
    Browse the repository at this point in the history
  2. ASLR: Add TODO comment

    n0toose committed Jun 16, 2024
    Configuration menu
    Copy the full SHA
    30e578f View commit details
    Browse the repository at this point in the history

Commits on Jun 17, 2024

  1. ASLR: Massive refactor

    n0toose committed Jun 17, 2024
    Configuration menu
    Copy the full SHA
    b26ab26 View commit details
    Browse the repository at this point in the history
  2. ASLR: Only use one feature

    - It's #[cfg(not(feature = aslr))], not #[not(cfg(feature = aslr))].
    - Some additional typo-induced bug was fixed.
    
    .-.
    n0toose committed Jun 17, 2024
    Configuration menu
    Copy the full SHA
    cecd8f8 View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    6eb3a18 View commit details
    Browse the repository at this point in the history
  4. ASLR: Set self.aslr_status to True later

    We should probably tell Uhyve that it is enabled once we are sure that nothing
    has gone wrong. What we should do when something goes wrong (can anything go
    wrong?) is an open question.
    n0toose committed Jun 17, 2024
    Configuration menu
    Copy the full SHA
    1b61351 View commit details
    Browse the repository at this point in the history