|
From: Sebastian B. <sb...@bi...> - 2004-08-30 20:46:01
|
Nicholas Nethercote wrote: > On Mon, 30 Aug 2004, Sebastian Biallas wrote: > >>> That would catch some of them. But the problem, AFAICT, with all >>> self-modifying code detection schemes is how to handle code on the >>> stack. For example, GCC generates snippets of code on the stack when >>> using nested functions. >> >> What? I thought this is highly undefined or at least deprecated, > > Seemingly not, see http://bugs.kde.org/show_bug.cgi?id=69511. Indeed, gcc emits "call %esp". > >> and with NX-aware processores and kernels it will no longer work. > > I'm no expert on that stuff, but I believe that GCC just turns off the > no-exec functionality in such systems in these cases. Nasty, huh? Very nasty: http://www.ussg.iu.edu/hypermail/linux/kernel/0406.0/1056.html Yesterdays technology tomorrow. > > N > Sebastian |