Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement ARM pointer auth stripping #195

Closed
Gankra opened this issue Jun 4, 2021 · 5 comments
Closed

Implement ARM pointer auth stripping #195

Gankra opened this issue Jun 4, 2021 · 5 comments

Comments

@Gankra
Copy link
Collaborator

Gankra commented Jun 4, 2021

ARM64 has an optional extension where certain pointers are obfuscated to help mitigate severe memory safety exploits. I have this stubbed out in the soon-to-land ARM64/ARM64_OLD unwinder:

fn ptr_auth_strip(ptr: Pointer) -> Pointer {
    // TODO: attempt to remove ARM pointer authentication obfuscation
    ptr
}

This extension is used on Apple's ARM64 platforms, see: https://bugzilla.mozilla.org/show_bug.cgi?id=1673755

@Gankra
Copy link
Collaborator Author

Gankra commented Jun 4, 2021

CC @mstange

@mstange
Copy link
Contributor

mstange commented Jun 4, 2021

Pasting my most recent comment from that bug here:

The easiest fix here would be to pick a fixed mask that works today, and change it once it stops working. 24 bits hash + 40 bits pointer seems to work well. The 24+40 split is also mentioned on https://lwn.net/Articles/718888/ and in various other resources: https://www.google.com/search?q=arm64e+pointer+authentication+40+24+bits

@Gankra
Copy link
Collaborator Author

Gankra commented Jun 20, 2021

Relevant libunwind code

@Gankra
Copy link
Collaborator Author

Gankra commented Oct 16, 2021

Completely forgot we dug up all this useful info -- so far in my local testing this kinda hacky approach in breakpad seems to work ok? https://searchfox.org/mozilla-central/rev/cc869830d5cb2482a123ed3a63782bfd5dcf74ec/toolkit/crashreporter/google-breakpad/src/processor/stackwalker_arm64.cc#58-79

(currently refining macos arm64 unwinding)

@Gankra
Copy link
Collaborator Author

Gankra commented Oct 19, 2021

Minimally implemented in #247

@Gankra Gankra closed this as completed Oct 19, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants