Benshan Mei mbs0221

Research Projects

Preventing Iago attacks on Keystone

Iago attack uses an attacker's ability of choosing return value of a procedure call, especially system calls. If the attacker is somehow proxying the procedure, and/or can inject arbitrary return value, she can use this to break confidentiality or integrity of the program. One example is getpid() in Apache. Apache uses the return value of getpid() system call to get non-repeating nonce for its child process. However, if the attacker can choose the return value, it means that she can choose an arbitrary nonce.

The original scenario introduced by the paper was based on a network adversary during remote procedure call (RPC).

RISC-V Extensions

Base	Description
RV32E	Base 32-bit ISA with 16 registers
RV32I	Base 32-bit ISA
RV64I	Base 64-bit ISA
RV128I	Base 128-bit ISA

| Extension | Description |

vsock notes

about vsocks

Vsocks are a means of providing socket communication (either stream or datagram) directly between VMs and their host operating system. The host and each VM have a 32 bit CID (Context IDentifier) and may connect or bind to a 32 bit port number. Ports < 1024 are privileged ports.

Vsock communication between VMs does not seem to work.
Only one vsock device per VM is supported.

	"""
	Adds PPTX Presenter Notes as PDF Text Annotations.
	This can then be used with `pdfpc` (https://github.com/pdfpc/pdfpc) for presentations.

	NOTE:
	<input.pptx> and <input.pdf> must contain the same number of pages.
	"""
	import sys

	from pptx import Presentation

	#include <atomic>
	#include <chrono>
	#include <immintrin.h>
	#include <iostream>
	#include <thread>

	struct Node {
	Node * prev{};
	Node * next{};
	};

	#!/usr/bin/python
	from bcc import BPF
	from time import sleep

	# This outputs a count of how many times the clone and execve syscalls have been made
	# showing the use of an eBPF map (called syscall).

	program = """
	BPF_HASH(syscall);

	using System;
	using System.Runtime.InteropServices;
	using static LowSharp;

	namespace LLVM
	{
	#region Enums
	//LLVMVerifierFailureAction
	public enum LLVMVerifierFailureAction : Int32
	{

	<!DOCTYPE html>
	<html lang="en">

	<head>
	<meta charset="UTF-8">
	<meta
	name="viewport"
	content="width=device-width, initial-scale=1.0"
	>
	<meta

	#include <linux/module.h>

	static inline uint64_t exec_rdmsr(uint64_t msr)
	{
	uint32_t low, high;
	asm volatile (
	"rdmsr"
	: "=a"(low), "=d"(high)
	: "c"(msr)
	);