▼
Showing posts with label x86. Show all posts
Showing posts with label x86. Show all posts
Monday, January 26, 2015

Control-flow processor exceptions (single-stepping on branches) on control-flow branch instructions (jmp/call/ret)

›
"single-stepping on branches" is processor hardware feature of x86/Intel architecture. When it is enabled, the processor generates...
Friday, January 16, 2015

How to defend against Stack Pivoting attacks on existing 32-bit x86 processor architecture?

›
Stack Pivoting is a common technique widely used by vulnerability exploits to bypass hardware protections like NX/SMEP, or to chain ROP ( Re...
5 comments:
Friday, November 21, 2014

Improve Performance for Separating Kernel and User Address Space with Process-Context Identifiers (PCIDs)

›
This post is not talking about any new idea, just about what I'm thinking..
Tuesday, November 18, 2014

Anybody knows How to Legitimately Register a PMI (PMU Performance Monitor Interrupt) Callback Handler on Windows OS?

›
According to IA32/Intel Software Development Manual, when some PMU (Performance Monitor Unit) counter overflows occur, or LBR (Last Branch R...
4 comments:
Monday, November 17, 2014

Implement software-based SMEP with Non-Execute (NX) bit in page tables to secure kernel/user virtual memory address space.

›
In my previous post , I talked about how to implement a software-based SMEP ( S upervisor Mode Execution Protection ) with virtualization/hy...
10 comments:
Sunday, September 28, 2014

Why smaller code size with XEN on ARM?

›
This white paper ( Xen ARM with Virtualization Extensions whitepaper )  indicates that " Xen on ARM is 1/6 of the code size of x86_64 X...

ARM TrustZone (Security Extension) and Virtualization Extension vs x86 Virtualization Technology

›
A typical virtualization system on both x86 and ARM includes three major parts: CPU virtualization Memory virtualization, and  I/O virtu...
Monday, July 14, 2014

Kernel Information Leak with Unprivileged Instructions (SIDT, SGDT) on x86 - WHY ?

›
In computer security, information leaking is one of threats to software security. For example, the memory address of kernel critical resourc...
2 comments:
Friday, June 13, 2014

Exploit NULL pointer dereference bug (ARM and x86)

›
A NULL pointer dereference occurs when a pointer with the value of 0 (NULL) is assumed to be a valid memory location, and that pointer is  t...
Sunday, May 18, 2014

Thoughts on Hardware Virtualization Exception (#VE)

›
Recently in the latest Intel SDM,  you can find that there is a new exception type, Virtualization Exception , in Chapter 6 (Interrupt and E...
2 comments:
Tuesday, May 06, 2014

Introduction to Processor Hardware Security Features in x86 & ARM Architectures

›
x86 and ARM processors both provide many hardware enforced security features, e.g. NX (No-eXecute) for executable space protection , to help...
Friday, April 11, 2014

Yet Another Solution to Monitor/Trap SYSCALL with Virtualization Technology (x86)

›
This article describes an idea to monitor SYSCALL with x86 Hardware Virtualization Technology. It doesn't require visible guest code/dat...