Re: ASLR+DEP = no problem. :>

[Alexander Sotirov <alex () sotirov net>]

On Thu, Feb 04, 2010 at 08:06:33PM +0100, Thierry Zoller wrote:
> > now, after reading the paper let me know if it requires a 'fix' as you
> > said, or a re-design/engineering and re-implementation of the JIT
> > itself. ;)
> Does not compute either. By "fix" I abviously assumed "redesign/eginner"
> the JIT. The point was that ASLR/DEP is not dead because of error in a
> JIT.

Are you making the claim that JIT spraying can be stopped by redesigning the
JIT? How exactly would you redesign the JIT to avoid inserting bytes controlled
by the attacker into the generated instruction stream?

Alex
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave