Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

The location in memory of a function is computed at compile time and then stored for later use by the program. If an attacker can overwrite certain function pointers, they may  he or she may be able to execute arbitrary code. To mitigate the effects of such attacks, pointers to functions can be encrypted at runtime based on some runtime on the basis of some characteristics of the execution process so that only a running process will be able to decode them.

...

Code Block
bgColor#FFCCCC
langc

int (*log_fn)(const char *, ...) = printf;
/* ... */
log_fn("foo");

...

Microsoft Windows provides the EncodePointer() and DecodePointer() function functions that encrypt and decrypt pointers using a secret that is unique to the given process.

Code Block
bgColor#ccccff
langc

int (*log_fn)(const char *, ...) = EncodePointer(printf);
/* ... */
DecodePointer(log_fn)("foo");

...

Code Block
bgColor#ccccff
langc

int (*log_fn)(const char *, ...) = encode_pointer(printf);
/* ... */
decode_pointer(log_fn)("foo");

...

MITRE CWE: CWE-311, "Missing Encryption encryption of Sensitive Datasensitive data"

...

Sources

[MSDN] EncodePointer(), DecodePointer()

...