|
From: Sebastian B. <sb...@bi...> - 2004-08-30 19:57:17
|
Nicholas Nethercote wrote: > On Mon, 30 Aug 2004, Sebastian Biallas wrote: > >> Don't know if there is much need for it, but it might be possible to >> make all pages that have PROT_EXEC | PROT_WRITE access >> read/execute-only and trap writes to these pages to automatically >> detect the situation. > > That would catch some of them. But the problem, AFAICT, with all > self-modifying code detection schemes is how to handle code on the > stack. For example, GCC generates snippets of code on the stack when > using nested functions. What? I thought this is highly undefined or at least deprecated, and with NX-aware processores and kernels it will no longer work. > > N > Sebastian |