24C3 - 1.01
24th Chaos Communication Congress
Volldampf voraus!
| Speakers | |
|---|---|
|
Peter Molnar |
|
|
Roland Lezuo |
| Schedule | |
|---|---|
| Day | Day 2 (2007-12-28) |
| Room | Saal 3 |
| Start time | 17:15 |
| Duration | 01:00 |
| Info | |
| ID | 2247 |
| Event type | lecture |
| Track | Hacking |
| Language | en |
| Feedback | |
|---|---|
|
Did you attend this event? Give Feedback |
Just in Time compilers - breaking a VM
Practical VM exploiting based on CACAO
We will present state of the art JIT compiler design based on CACAO, a GPL licensed multiplatform Java VM. After explaining the basics of code generation, we will focus on "problematic" instructions, and point to possible ways to exploit stuff.
A short introduction into just-in-time compiler techniques is given: Why JIT, about compiler invocation, runtime code modification using signals, codegeneration. Then theoretical attack vectors are elaborated: language bugs, intermediate representation quirks and assembler instruction inadequacies. With these considerations in mind the results of a CACAO code review are presented. For each vulnerability possible exploits are discussed and two realized exploits are demonstrated.