Conversation

Have you seen Samsung's kernel CFI implementation from before they gave up and moved to Google's upstream Clang CFI? It's the most horrifying thing and by that I mean they pass compiled kernel code through a Python script using objdump to add CFI instrumentation as a total hack.
2
17
The only thing they actually implemented in the compiler (still GCC) was adding NOP padding for them to use in their post-processing Python script along with reserving at least one register. Extremely coarse-grained indirect call CFI + ret addr XOR with random value in register.
1
1
Samsung's horrible CFI only prevented indirect calls not calling an actual function. It had no compiler analysis or anything since it was literally just a Python script post-processing the disassembled code (via objdump). Haven't seen many worse things done with computers.
1
4
Check this out: github.com/djb77/samsung- It's horrible. They have GCC reserve 3 registers and output a bunch of NOP instructions for them to use in this horrifying script. The conversation just happened to remind me of this nightmarish thing.
1
3
Show replies