Asia-24-Ye-One-Flip-Is-All

#BHASIA @BlackHatEventsOne Flip is All It Takes: Identifying Syscall-Guard Variables for Data-Only Attacks Speaker: Hengkai YeThe Pennsylvania State UniversityOther Contributors: Hong Hu, Song Liu, ZhechangZhang2TeamHengkaiYePh.D. StudentPenn State UniversitySong LiuPh.D. StudentPenn State UniversityZhechangZhangPh.D. StudentPenn State UniversityHong HuAssistant ProfessorPenn State University3Current Exploit Method: Control-Flow HijackingMemory-Access PrimitivesArbitrary ReadArbitrary WriteControl DataReturn Address Function PointerControl-FlowHijackingCode InjectionCode Reuse4Control-Flow HijackingMemory-Access PrimitivesArbitrary ReadArbitrary WriteCode InjectionCode ReuseControl DataReturn Address Function PointerCode-Pointer IntegrityControl-Flow IntegrityCurrent Exploit Method: Control-Flow Hijacking5Control-Flow HijackingMemory-Access PrimitivesArbitrary ReadArbitrary WriteCode InjectionCode ReuseControl DataReturn Address Function PointerNon-Control DataData-Only AttackData-Orie