Shellcode detection using CPU emulation and syscall blacklisting

rainbow.cs.unipi.gr

35 points·luu··7 comments

I had an idea a while back for a HIDS or at least post-infection analysis. You record incoming data and files onto storage. Have a separate machine running it which is instrumented to check all jumps, etc against a whitelist generated when compiling same system. It would eventually spot the compromise plus be able to show the exact sequence of data & instructions that caused it. Which would aid patching it.

Stayed on prevention instead. Thought it would be fun building & optimizing it, though.

this is control flow integrity, it's in windows 10 now as a technology called "control flow guard".

"Bypass control flow guard" :)

https://www.blackhat.com/docs/us-15/materials/us-15-Zhang-By...

Doesn't surprise me. There's been few breaks in prior SFI/CFI's. That's why I'm not relying on CPI until strong peer review happens. There's added risk since CFI concept is really a cheat to try to avoid full data or memory safety. They think they'll get security and great performance with the cheat. They usually get the performance. ;)

I havent read it yet: was talking on topic in general. Cool they have CFI in Windows now, though. Most exciting thing Ive seen in that sub-field was Code Pointer Integrity. Really want the people who broke other CFI's to have a go at it. That and Softbound/Hardbound for more thorough cases.

That's what lastline is doing its based on Anubis.

Holy crap, it looks like they are! Neat to see my old proposal become real. It will be interesting to compare their version functionality to my specs.

Reply on news.ycombinator.com