openbsd-src/lib/csu/amd64/ at trash-bin2 · jcs.org/openbsd-src

jcs.org / openbsd-src

jcs's openbsd hax

openbsd

openbsd-src / lib / csu / amd64 /

at trash-bin2 1 file

crt0 MD _dl_exit() performs syscall to SYS_exit directly, but then some of these functions were returning. That makes the +1word address a fairly strong and easily located gadget. Put a hard-trap instruction after the syscall. This remains a gadget for 'terminal system' calls (such as execve), but hey that's why we have pledge w/o "exec" throughout the tree. Quite surprisingly, hppa's delay-slot load of SYS_exit makes it the safest of the bunch, not that this helps anyone. ok kettenis

5 years ago