Just-In-Time Code Reuse - The More Things Change, the More They Stay the Same
Explore the concept of just-in-time code reuse and its implications for fine-grained address space layout randomization (ASLR) in this Black Hat USA 2013 conference talk. Delve into the design and implementation of a framework that challenges the effectiveness of fine-grained ASLR and simplifies exploit development on platforms combining standard ASLR and DEP. Learn how this novel attack strategy exploits memory disclosure to map application memory layouts, discover API functions and gadgets, and JIT-compile target programs within a script environment. Witness a real-world exploit demonstration against Internet Explorer on Windows 8, and examine extensive evaluations showcasing the practicality of just-in-time code reuse attacks. Gain insights into the potential limitations of fine-grained ASLR as a security measure and consider the implications for future cybersecurity strategies.