Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

quitesimple.org

Post reply on HN
Print view View original

81–84 of 84 posts

Re: Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

#81

Post by account42 »

gigel82 wrote: post #62

How does this work with dynamic libraries (shared objects). In Windows land, you get a .lib with a .dll and afaik that has hardcoded function addresses. You statically link the "import library" .lib with your exe, so if you randomize the function addresses and rebuild just the .dll later, it blows up (you need to rebuild all exes as well). Is dynamic linking in Unix world truly runtime-only (a-la "GetLibrary" / "GetP…

Unix/ELF doesn't have seperate .lib and .dll files - you link directly against the .so (or a linker script, but those are typically only used for special system libraries). The main thing this does is record the name from the DT_SONAME field of the .so as a requied dependency in your binary.

But I also don't think that this would be a problem on Windows. After all, you can generally replace DLLs with entirely different versions and you'll be fine as long as all the required symbols are present and ABI-compatible.

The main difference between ELF and PE dynamic linking is that with PE you have a list of required symbols along with the libraries to load those symbols from while with ELF you have a list of required libraries and a list of required symbols but not information recorded about which symbols should come from which libraries.

Re: Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

#82

Post by anthk »

batman-farts wrote: post #44
atlgator wrote: post #34

I remember my Gentoo days freshman year in college. I spent more time compiling updates than actually using the computer.

These days my 5950X can get through some of the big scary packages quite rapidly. Firefox is done in about 8 minutes, a new point release of Rust seems to take about 15. I still haven’t decided whether or not I should be embarrassed that I mainly bought a 16-core CPU to run Gentoo.

Do you use ccache?

Re: Fun with Gentoo: Why don't we just shuffle those ROP gadgets away?

#83

Post by chlorion »

withinboredom wrote: post #27
ectopod wrote: post #16

Earlier quoted context omitted.

You can bootstrap the compiler. It's a chore but not impossible. More usefully, you can check that your builds are identical to other people's, so at least your compiler isn't uniquely compromised.

I don’t think it’s possible since you’d need the original compilers from the 70’s and bootstrap other compilers up to a modern one. Otherwise your existing compiler could taint your new one.

There are people who spend time trying to solve this issue!

https://bootstrappable.org/

https://www.gnu.org/software/mes/

The idea here, is that if you can get a very basic C compiler, you can start building TinyCC, and eventually build a pre-C++ version of GCC, and from there build up to modern GCC. This is a lot easier said than done of course, but not quite as bad as needing the original compilers from the 70s!

Post reply on HN