Hacker News Reader

Comment by udp | Hacker News Reader

How do W^X restrictions affect something like this? I assume there must be a way to work around it given the prolificacy of JITing VMs, but interested in the details. The last time I was fiddling with machine code in memory was before W^X was a thing.

View on HN

Use mprotect to change the access protection flags on a page of memory. Assuming it is initially allocated as write but no execute (PROT_READ|PROT_WRITE), write your machine code to it, then change it to read-only and execute (PROT_READ|PROT_EXEC).

http://man7.org/linux/man-pages/man2/mprotect.2.html

mprotect is part of POSIX, so works on Linux, macOS, etc.

The Windows equivalent is VirtualProtect

https://msdn.microsoft.com/en-us/library/windows/desktop/aa3...

Annoyingly this doesn't apply on the most modern platforms... see windows phone/universal etc as well as mobile platforms, consoles and all sorts of embedded systems.

(ps I did a significant chunk of this for https://code.google.com/archive/p/fridgescript/ back when this made real sense, I'm not just making hot air... this is quite a mediocre result imo ... bedroom stuff from years ago..,)

There are AsApp variants on UWP, if you claim the JIT permission.

I've written a demonstration of this sort of thing in Ruby, where I scribble a cdecl function to memory and execute it, with the end goal being: invoke the cpuid instruction to get info about the processor.

http://www.cstrahan.com/posts/2013-07-15-pure-ruby-cpuid-via...

Reply on news.ycombinator.com