disconnect3d

Goals

This documents tries to address some concerns with enabling PIE.

Argument 1

One of the criticism of "Using PIE by default on AMD64" is,

disconnect3d

In [9]: def foo():
   ...:     return x
   ...: def foofoo(x):
   ...:     return x
   ...: def bar():
   ...:     x += 1
   ...: def foobar():
   ...:     global x
   ...:     x += 1
   ...:

disconnect3d

package main

import (
    "time"
    "fmt"
)

func main() {
    bundles := make(chan int, 5)
    cancelProcessing := make(chan struct{})

disconnect3d

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

if args.LOCAL:
    if not args.DBGBIN:
        exe = context.binary = ELF('../private/binary/atm')
    else:
        exe = context.binary = ELF('../private/binary/atm_debug')

disconnect3d

Linux

Containers/jails

• docker
• https://github.com/google/gvisor
• https://github.com/google/nsjail
• https://github.com/netblue30/firejail (e.g. compiler-explorer uses this)
• https://podman.io/
• systemd-nspawn
• https://github.com/lxc/lxc

disconnect3d

#include <stdio.h>
#include <stdlib.h>

#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>

int* shared;

disconnect3d

Bug PoC below. Reported in https://www.postgresql.org/message-id/CABEVAa1dU0mDCAfaT8WF2adVXTDsLVJy_izotg6ze_hh-cn8qQ%40mail.gmail.com and fixed in https://www.postgresql.org/message-id/23800.1580509696%40sss.pgh.pa.us

This is correct:

> select json_to_tsvector('"abc"'::json, '"string"')
json_to_tsvector
--
'abc':1

disconnect3d

// g++ spam.cpp -O3 -lpthread -std=c++14 && ./a.out
#include <stdio.h>
#include <stdint.h>
#include <thread>
#include <immintrin.h>

__attribute__ ((target ("rdrnd")))
void exec(int id) {
    printf("[thread %d]\n", id);

disconnect3d

32-bit ELF binary

how to assemble and link:

nasm -f elf32 -o <filename>.o <filename>.asm
ld -m elf_i386 -o <filename> <filename>.o

template code (hello world):

section .text
global _start

disconnect3d

How to make a Release Android App debuggable

Let's say you want to access the application shared preferences in /data/data/com.mypackage.
You could try to run adb shell and then run-as com.mypackage ( or adb shell run-as com.mypackge ls /data/data/com.mypackage/shared_prefs), but on a production release app downloaded from an app store you're most likely to see:

run-as: Package 'com.mypackage' is not debuggable