XOM-switch: Hiding Your Code from Advanced Code Reuse Attacks In One Shot
summary
A deployable tool called XOM-switch statically patches ld.so to enable executable-only pages on Intel CPUs using PKU/protection keys without source or heavy binary rewriting. It maps code pages at load time, uses WRPKRU/PKRU to flip permissions in 60–120 cycles (versus ~20,000 for mprotect), supports 16 protection keys per process, and adds ~7% code size (glibc +0.9%). On Firefox a 104 MB code footprint yields 1.5 MB readable, 57% executable-only, 40% read-only (≈97% reduction); code is open source (xom-switch.git) and requires Linux ≥4.9 and radare2 for patching.
AI-written summary · about
chapters (12)
- 0:00Introduction and background
- 1:04Code reuse attack landscape
- 4:18Limitations of current defenses
- 8:43Intel protection keys explained
- 12:06Leveraging MPK for security
- 16:20Executable-only memory design
- 17:40Binary patching methodology
- 20:06Implementing the loader patch
- 26:21Securing against MPK abuse
- 28:18Evaluation and performance
- 31:08Attack effectiveness analysis
- 32:31Practical usage and conclusion
related talks
28mIt's Not a Best Practice If No One Can Follow It: Learning From...
52mIntra-Process Memory Protection for Applications on ARM and X86: Leveraging the ELF ABI
16mThe Cost of Performance: Breaking ThreadX with Kernel Object Masquerading...
35mOn Securing Legacy Software Against Code-Reuse Attacks
50mMPK/PKS Linux Kernel Compartmentalization
30mProactive Software Defense against Side Channel Attacks
33mOpen & Secure: Novel Sandboxing Technique for Any Open Source Library
37mThe Hacker’s Perspective: Zephyr OS and On-Device Runtime Protection