Главная
Study mode:
on
1
Intro
2
JavaScript Values
3
JIT Compilers
4
JavaScript
5
Type Information
6
Example
7
Speculation Guards
8
Speculation All
9
JIT Compiler Pipeline
10
Summary
11
Bug Categories
12
Lowpass handlers
13
Takeaway
14
Optimization
15
Optimizations
16
bounds checking
17
check bounced
18
range analysis
19
speed analysis
20
bounce check
21
what could go wrong
22
NVH
23
Exploit
24
More examples
25
What is redundancy
26
How would you do this
27
The function
28
Shape guards
29
Arrays
30
Objects
31
Pseudocode
32
Abstract Interpreter
33
CreateThis
34
Graph Building
35
Check Hoisting
36
Demo
37
Calculator
38
KXTed
39
Conclusion
Description:
Explore the security aspects of JavaScript JIT compilers in this Black Hat conference talk. Delve into the challenges faced by these compilers and the solutions implemented by prominent engines. Examine JavaScript values, type information, speculation guards, and the JIT compiler pipeline. Investigate bug categories, optimization techniques, and potential vulnerabilities. Learn about shape guards, arrays, objects, and abstract interpretation. Analyze practical examples and demonstrations, including a calculator exploit. Gain insights into new trends in browser exploitation and understand the implications for client-side security.

Attacking Client-Side JIT Compilers

Black Hat
Add to list