Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit cf8c516

Browse filesBrowse files
committed
[BOLT] Gadget scanner: detect authentication oracles
Implement the detection of authentication instructions whose results can be inspected by an attacker to know whether authentication succeeded. As the properties of output registers of authentication instructions are inspected, add a second set of analysis-related classes to iterate over the instructions in reverse order.
1 parent ff86e1d commit cf8c516
Copy full SHA for cf8c516

File tree

4 files changed

+1354
-0
lines changed
Filter options

4 files changed

+1354
-0
lines changed

‎bolt/include/bolt/Passes/PAuthGadgetScanner.h

Copy file name to clipboardExpand all lines: bolt/include/bolt/Passes/PAuthGadgetScanner.h
+12Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -261,6 +261,15 @@ class ClobberingInfo : public ExtraInfo {
261261
void print(raw_ostream &OS, const MCInstReference Location) const override;
262262
};
263263

264+
class LeakageInfo : public ExtraInfo {
265+
SmallVector<MCInstReference> LeakingInstrs;
266+
267+
public:
268+
LeakageInfo(const ArrayRef<MCInstReference> Instrs) : LeakingInstrs(Instrs) {}
269+
270+
void print(raw_ostream &OS, const MCInstReference Location) const override;
271+
};
272+
264273
/// A brief version of a report that can be further augmented with the details.
265274
///
266275
/// It is common for a particular type of gadget detector to be tied to some
@@ -302,6 +311,9 @@ class FunctionAnalysis {
302311
void findUnsafeUses(SmallVector<BriefReport<MCPhysReg>> &Reports);
303312
void augmentUnsafeUseReports(const ArrayRef<BriefReport<MCPhysReg>> Reports);
304313

314+
void findUnsafeDefs(SmallVector<BriefReport<MCPhysReg>> &Reports);
315+
void augmentUnsafeDefReports(const ArrayRef<BriefReport<MCPhysReg>> Reports);
316+
305317
public:
306318
FunctionAnalysis(BinaryFunction &BF, MCPlusBuilder::AllocatorIdTy AllocatorId,
307319
bool PacRetGadgetsOnly)

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.