security - Using a separate register to store return address? -


i'm reading how exploits work, , seems lot of them operate overwriting return address on stack. there's been lot of effort put making more difficult (stack canaries, aslr, dep, etc), seems me easier hardware producers add register, accessible call , ret instructions, hold return address. way, return address not overwritten buffer overflow definition. because call , ret still present , still operate in today's cpus (the difference store return address), seem me there wouldn't many issues compatibility. , since you're using register instead of ram access address, performance impact positive (albeit insignificant).

intel apparently has space allocate more registers security purposes, since mpx being implemented despite needing 2 registers. why don't add special register store return address?

this kinda exists. know 3 architectures , 1 language features that:

  • sparc has called register windows cpu saves , restores registers 1 function call/return. convention, return address stored in register o7 on function call, rotated i7 when callee establishes stack frame. when callee calls function, address rotated away internal register stack, untouchable dangerous code.
  • knuth's mmix has similar design return address stored directly inaccessible register stack on function call, pretty want.
  • arm , arm64 have link register. on function call, return address stored in link register, function return indirect jump address in link register. doesn't want content of link register must stored in stack in nested function calls, defeating security in leaf functions (i.e. functions call no other functions).
  • the forth programming language has design 1 stack values , separate stack return addresses. both stacks can manipulated freely programs, though need careful when manipulating return stack. in practice, implemented using 1 of architecture's registers return stack , 1 data stack. solves problem mentioned sufficiently clever programmer still mess allowing wrong input smash return stack.

Comments

Popular posts from this blog

python - Selenium remoteWebDriver (& SauceLabs) Firefox moseMoveTo action exception -

html - How to custom Bootstrap grid height? -

Ruby Google Calendar Integration Watch Event / Push Notification -