Canaries: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
mNo edit summary
No edit summary
Line 13: Line 13:
Theoretically, only syscalls, but it's unknown for sure.
Theoretically, only syscalls, but it's unknown for sure.


==Examples of Canaries==


 
Here in naehrwert's blog you can see an example:
http://nwert.wordpress.com/2012/09/19/exploiting-lv2/
(check point 2. for the details)


{{File Formats}}
{{File Formats}}
<noinclude>[[Category:Main]]</noinclude>
<noinclude>[[Category:Main]]</noinclude>

Revision as of 14:00, 29 May 2014

What are canaries?

From wiki: http://en.wikipedia.org/wiki/Buffer_overflow_protection#Canaries

"Canaries are known values that are placed between a buffer and control data on the stack to monitor buffer overflows."

Those are also present in the PS3 system and they're initialized at kernel startup from timebase counter (ticks).

You can't control them however. These are one of the obstacles against kernel(lv2) exploits.

What functions should have these guards?

Theoretically, only syscalls, but it's unknown for sure.

Examples of Canaries

Here in naehrwert's blog you can see an example: http://nwert.wordpress.com/2012/09/19/exploiting-lv2/ (check point 2. for the details)