Collected research
Too LeJIT to Quit: Extending JIT Spraying to ARM
On ARM, constants a JIT compiler embeds in Thumb code can be entered mid-instruction to produce short unintended instruction sequences. Gadget chaining calls these sequences like functions from ordinary JavaScript, giving an attacker with a control-flow bug arbitrary computation against WebKit JavaScriptCore despite DEP, ASLR, constant blinding and NOP insertion.
Record
- Researcher
- Wilson Lian, Hovav Shacham and Stefan Savage
- Published by
- ndss-symposium.org
- Format
- Whitepaper
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Wilson Lian, Hovav Shacham and Stefan Savage, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .