1. Lets say you are an attacker wishing to exploit the code in part A. Assume that all memory protections have been disabled and the stack looks similar to figure 1. Your task is to construct a string that will overflow the buffer and crash the program. Given below are pointers to construct the string. Use them and construct the malicious input string. We will assume that the machine is a 64-bit Intel x86 machine. Note that to avoid fragmentation the buffer size will be rounded off to the nearest multiple of word size (refer to lecture notes if this point is not clear to you.) To crash the program a garbage instruction needs to be written after the return address, which will occupy 64-bit on stack. Usually, a no-operation command (NOP), which is the string \x90, is used as a garbage instruction as it does not do anything. Your exploit string is basically appropriate number of \x90 concatenated together. Remember that the stack gets filled from lower memory address to higher memory address in buffer overflow scenarios and dont forget that the size of \x90 is 1 byte.

2. Read the following paragraph carefully and answer. Just-In-Time (JIT) compilation executes a program by compiling it during its execution, rather than prior to its execution. This is especially useful in browsers as it significantly speeds up Javascript execution. JIT compiler writes code into memory, so that memory must be marked writable. Also, since the output of JIT compiler is machine code that is being executed at the same time of its generation, there is no time to copy that code into another memory location which is executable. Due to this restriction, JIT compilers output is stored in memory which is both writable and executable. Consider that the victim is using a machine which is protected by WX and DEP and it supports JIT. The machine has additional protections to prevent return-to-libc attacks but anything using JIT is a fair game.. Does the use of JIT allow the attacker to bypass WX and DEP protections? Why or why not?

Lower Memory Address Higher Memory Address buf return address Stack Pointer Figure 1: Figure for Problem 20 Lower Memory Address Higher Memory Address buf return address Stack Pointer Figure 1: Figure for Problem 20