Capturing 0Day Exploits With Perfectly Placed Hardware Traps

on YouTube ↗48m

" summary

Prototype enforces runtime CFI by using PMU+LBR traps to break on mispredicted indirect calls, reading LBR to get the true target, and consulting an on-load whitelist built from relocations, exports and callbacks in kernel ISR. Works on Linux and Windows after solving PatchGuard-safe interrupt registration and an APC-based thread tracking trick; hypervisors often lack required LBR events. Tests see 13–14M mispredicts on older cores (far fewer on Haswell/Skylake), ~10% typical overhead, and ~95% ROP detection (37/48) plus 100% for one flash technique.

AI-written summary · about

" chapters (45)

1. 0:00Intro
2. 1:47Exploit Research
3. 3:07Exploit Phases
4. 5:28Hardware Assistance
5. 5:59Performance Monitoring Unit
6. 7:40Branch Prediction Unit
7. 8:56Branch Prediction Logic
8. 9:44Control Flow Integrity
9. 10:59Control Flow Guard
10. 12:47RealWorld Verification
11. 13:28CFI
12. 13:42Research Approach
13. 15:55Comparison
14. 16:43PMU
15. 17:12Intel Manual
16. 17:58The Problem
17. 21:39Cyber Grand Challenge
18. 22:24RealWorld Data
19. 24:30Plotting Data
20. 26:04Whitelisting
21. 26:19Waitlist Generation
22. 28:14Callback Registration
23. 28:35Clearing Interrupts
24. 29:02XC PIC vs X2 PIC
25. 29:50Call Registry
26. 30:08Thread Tracking
27. 30:37Window Monitoring
28. 31:10Synchronous Procedure Calls
29. 32:08The Final Solution
30. 32:44The Diagram
31. 33:12Linux
32. 33:35Results
33. 35:45Performance
34. 36:11Metasploit
35. 36:48VirusTotal
36. 37:08Analysis
37. 38:35Case Studies
38. 39:19Double Free Jscript
39. 40:56Flash
40. 41:48Hijack
41. 42:41Future work
42. 43:46Exploit defenses
43. 46:05False positives
44. 46:54Microcontroller architectures
45. 47:17ARM

" related talks

• 41mUsing Microarchitectural Design to Break KASLR and MoreAnders Fogh · RuhrSec 2017
• 15mMemoryTrap: Booby Trapping Memory to Counter Memory Disclosure Attacks with...Jiang Ming, Dongpeng Xu, Chenke Luo, Guojun Peng, Jianming Fu · USENIX ATC '25
• 42mCPU Fuzzing: Automatic Discovery of...Daniel Weber, Michael Schwarz · RuhrSec 2023
• 14mBranch Privilege Injection: Compromising Spectre v2 Hardware Mitigations by...Kaveh Razavi, Sandro Rüegge, Johannes Wikner · USENIX Security '25
• 51mExploiting Hardware Glitches And Side Channels In Perfect SoftwareHerbert Bos · OWASP Global AppSec Amsterdam 2019
• 49mBypassing KPTI Using the Speculative Behavior of the SWAPGS InstructionAndrei Lutas, Dan Lutas · Black Hat Europe 2019
• 13mExploiting Inaccurate Branch History in Side-Channel AttacksAlessandro Biondi, Yuhui Zhu · USENIX Security '25
• 36mLost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented ProgrammingSeunghun Han · Black Hat USA 2023