JIT Spraying Never Dies

Recommendations

Info

The Speed of WARP JIT Spraying Out of 535M private bytes, WARP JIT data/code only accounts for 19M It takes approx. 4.5 minutes to spray a space of 19M Data Check this option to Code add support for D3D10
The Solution to Challenge I & II • Without the ability of Arbitrary Address Read/Write(AAR/AAW), there seems to be not much we can do to get these problems solved! • Magic will happen with the help of AAR/AAW. • Manipulates the internal data structure of D3D to force the instant functioning of WARP module on any platform (simply call LoadLibrary will NOT work though)! • Tweaks the internal parameter of WARP JIT page allocation to reduce the whole JIT spraying time to only a few second!
Page 1 and 2: JIT Spraying Never Dies - Bypass CF
Page 3 and 4: About Speakers • Bing Sun - Bing
Page 5 and 6: Background Knowledge • Direct3D &
Page 7 and 8: Software Rasterizer & WARP • Soft
Page 9 and 10: GLSL & HLSL • Shading Language -
Page 11 and 12: WebGL and Its Usage • WebGL (Web
Page 13 and 14: The Basic Principle of CFG • Abou
Page 15 and 16: Known CFG Bypass Methods • Call V
Page 17 and 18: The Security Assessment on WARP Sha
Page 19 and 20: Separation of Data and Code Data Co
Page 21 and 22: The Weakness of WARP Shader JIT Eng
Page 23 and 24: No CFG for JITed Code Data Code
Page 25: WARP Module Not Loaded Web page con
Page 29 and 30: The Solution to Challenge III • S
Page 31 and 32: The Solution to Challenge III (cont
Page 33 and 34: MS16-063 typedarray.subarray(ropsta
Page 35 and 36: CVE-2016-0193 (jmp) esi -> Fake vft
Page 37 and 38: The Possibility of Exploiting 64-bi
Page 39 and 40: Demo - MS16-063
Page 41 and 42: Extra Demo • Other 0day CFG/DEP B
Page 43 and 44: Demo - CFG/DEP Bypass 0day II Creat
Page 45 and 46: Q&A • You are welcomed to send qu

JIT Spraying Never Dies

Create successful ePaper yourself

Delete template?

Save as template?