JIT Spraying Never Dies

Recommendations

Info

Rendering Pipeline & Shader • Rendering Pipeline – Refers to the sequence of steps used to create a 2D raster representation of a 3D scene, and it is the process of turning 3D model into what the computer displays. – Modern GPUs use a programmable rendering pipeline that makes it possible to write your own functions to control how shapes and images are rendered using vertex and fragment Shaders. • Shader – Shader: An user-defined program that is used to do Shading (the production of appropriate levels of color within an image, or to produce special effects or do video post-processing). Shader is designed to execute one of the programmable stages of the rendering pipeline. – Vertex Shader: A pipeline stage that handles the processing of individual vertices, and it performs transformations to post-projection space (vertex's 3D position in virtual space to the 2D coordinate), and per-vertex lighting etc. – Fragment Shader (aka. Pixel Shader): A pipeline stage after a primitive is rasterized, and it processes a fragment (pixel) generated by the Rasterization into a set of colors and a single depth value.
GLSL & HLSL • Shading Language – A graphics programming language adapted to programming Shader effects (characterizing surfaces, volumes, and objects). • GLSL (OpenGL Shading Language) – A high-level shading language based on the syntax of the C programming language. – It was created by the OpenGL ARB (OpenGL Architecture Review Board) to give developers more direct control of the graphics pipeline without having to use ARB assembly language or hardware-specific languages. • HLSL (High-Level Shading Language) – A proprietary shading language developed by Microsoft to augment the Shader assembly language. – HLSL is analogous to the GLSL shading language used with the OpenGL standard.
Page 1 and 2: JIT Spraying Never Dies - Bypass CF
Page 3 and 4: About Speakers • Bing Sun - Bing
Page 5 and 6: Background Knowledge • Direct3D &
Page 7: Software Rasterizer & WARP • Soft
Page 11 and 12: WebGL and Its Usage • WebGL (Web
Page 13 and 14: The Basic Principle of CFG • Abou
Page 15 and 16: Known CFG Bypass Methods • Call V
Page 17 and 18: The Security Assessment on WARP Sha
Page 19 and 20: Separation of Data and Code Data Co
Page 21 and 22: The Weakness of WARP Shader JIT Eng
Page 23 and 24: No CFG for JITed Code Data Code
Page 25 and 26: WARP Module Not Loaded Web page con
Page 27 and 28: The Solution to Challenge I & II
Page 29 and 30: The Solution to Challenge III • S
Page 31 and 32: The Solution to Challenge III (cont
Page 33 and 34: MS16-063 typedarray.subarray(ropsta
Page 35 and 36: CVE-2016-0193 (jmp) esi -> Fake vft
Page 37 and 38: The Possibility of Exploiting 64-bi
Page 39 and 40: Demo - MS16-063
Page 41 and 42: Extra Demo • Other 0day CFG/DEP B
Page 43 and 44: Demo - CFG/DEP Bypass 0day II Creat
Page 45 and 46: Q&A • You are welcomed to send qu

JIT Spraying Never Dies

Create successful ePaper yourself

Delete template?

Save as template?