XOM-switch: Hiding Your Code from Advanced Code Reuse Attacks In One Shot
summary
Claims a working tool XOM-switch that flips userland code pages to execute‑only using CPU PKU support, applied to deployed Linux binaries without needing source or heavyweight binary rewriting. It provides an end‑to‑end loader/instrumentation that marks and protects code pages at runtime, integrates with normal process startup, and requires only PKU‑capable CPUs. The authors release a proof‑of‑concept implementation and report it successfully enforces XOM on real applications.
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:19blackhat Overview
- 1:29blackhat Script Based Threats
- 4:19blackhat Obfuscation
- 4:44black hat The Cat and Mouse Game
- 5:57black hat Encryption
- 6:40black hat Detect the Obfuscators
- 8:01black hat AMSI - Supported Vendors
- 8:49black hat AMSI - Enumerations
- 9:20black hat AMSI - Functions
- 18:03black hat AMSI - Architecture
- 19:28black hat Building a Provider
- 29:22blackhat Scan Dispatching
- 30:41black hat Bypassing AMSI
- 31:58blackhat Implementation Flaws
- 33:04black hat COM Server Hijacking
- 34:01blackhat Missing DLL
- 37:09black hat AmsiEnable Bypass
- 39:18blackhat Implementation Issues
- 39:36black hat Fundamental Issues
- 39:48blackhat One Liner
related talks
16mThe Cost of Performance: Breaking ThreadX with Kernel Object Masquerading...
37mEternal War in XNU Kernel Objects
32mYou Can Run, but You Can't Hide - Finding the Footprints of Hidden Shellcode
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...
23mHardening Hypervisors with Ombro
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
50mMPK/PKS Linux Kernel Compartmentalization
49mBreaking Hardware-Enforced Security With Hypervisors