In a previous post, I described how to inject code to execute syscall by overwriting the stack. To summarize the previous post ROP (Return Oriented Programming) is a technique which can bypass the Non-Executable Stack to execute arbitrary code. We still need the ability to overwrite the stack (it can not bypass Stack Smashing [ ]
I will use the simplest code sample which allows a stack overflow attack to happen. The code snippet does the following things Mitigations Before I explain the actual attack, let s first discuss the various techniques that are employed by compilers and operating systems to prevent this type of attack. I will disable these mitigations while [ ]
I have used Bare bones setup described by OSDev to jump into the Long Mode and run a small C program. The bare bones setup initializes a graphical device and provides a framebuffer for manipulating the device i.e we can print anything by setting bits to turn on/off the pixels in the device. The above [ ]
The Popek/Goldberg Theorem Introduced in a paper in 1974, Can be used to determine whether a given ISA can be virtualized by a VMM using multiplexing. For any ISA meeting the hypothesis, any OS that can run directly on the hardware can also run on VMM written for that ISA. Original intent was to prove [ ]
These are the notes of the book Hardware and Software Support for Virtualization by Bugnion, Nieh, Tsafrir (Synthesis Lectures on Computer Architecture) Historical Perspective Three techniques are used in virtualization. Multiplexing - Operating System s scheduler, multiplexes a physical CPU across time and uses this to provide an abstraction called process to the users. Aggregation [ ]
xv6 loads the userspace program starting from the virtual address 0x0, which means we can dereference a null pointer in a xv6 process and it will be a valid memory access. Compiling and running the above program, xv6 kernel throws an illegal opcode error. If we look at the assembly for the test_defp binary, we [ ]
We can solve any problem by introducing an extra level of indirection. David J. Wheeler Consider the following user-space program, which makes a system call getpinfo. getpinfo is a syscall which accepts pointer to a struct, it will populate the struct with some attributes of all running processes (kind of a ps command).Below code snippet [ ]
During the MySQL/MariaDB Internals hack week, I worked on adding the following feature in MariaDB. MDEV-32854 : Make JSON_DEPTH_LIMIT Configurable JSON DataType in MariaDB In MariaDB, JSON data type is implemented as an alias of LONGTEXT Data type which can hold 4GB of text. For the JSON Datatype MariaDB validates the JSON string before storing [ ]
Spark comes with several in-built aggregation functions however if those do not satisfy the use case than writing your own User Defined Aggregation Function (UDAF for short) is simpler and cleaner way. In this post, I will be describing how to implement a Spark UDAF to compute harmonic mean using Java. UDAFs in spark are created [ ]