Compiler Bugs And Bug Compilers
summary
Shows concrete compiler modifications that reliably insert exploitable behavior into Linux binaries using GCC plugins and direct GCC changes. Demo replaces a printf argument so a hello world prints “hail Satan,” removes SQLite sanitizers to reintroduce a memcopy overflow that spawns a shell/abacus, flips a tail-call jump into a call to smuggle a return address, and extends an inlined memcpy by one byte to flip an auth flag. Uses GCC 7, RTL/CHiMP/ASM dumps and the init_array constructor trick; all demos compile and run.
AI-written summary · about
chapters (11)
- 0:00Introduction to compiler attacks
- 1:42Why GCC and compiler internals
- 10:14Debugging GCC representations
- 15:53Demo: Malicious compiler plugin
- 27:23Demo: Unpatching SQLite bug
- 35:25ELF format and init array attacks
- 37:49Demo: init array manipulation
- 45:40Tail call optimization attacks
- 53:47Built-ins and stealthy bugs
- 58:24Demo: Configurable mem copy bug
- 1:03:19Mitigations and recommendations
related talks
01h 27mDangerous Optimizations! in C++ - Part Deux
53mLocknote: How Badly Do We Want Correct Compilers?
01h 25mPeeking Into Your Compiler
59mCompilers can be surprising
22mDemostrating Binary Exploitation
01h 16m“What Has My Compiler Done for Me Lately? Unbolting the Compiler's Lid”
22mBoosting Compiler Testing by Injecting Real-World Code
44mDebugging memory corruptions in C++