2026-09-19T08:52:31Zhttps://dspace.mit.edu/server/oai/request

oai:dspace.mit.edu:1721.1/1128602026-06-06T00:49:33Zcom_1721.1_7582com_1721.1_7581col_1721.1_131023

Martin C. Rinard and Stelios Sidiroglou-Douskos. Davis, Eli Bristol Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science. Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science 2017-12-20T18:15:08Z 2017-12-20T18:15:08Z 2016 2016 http://hdl.handle.net/1721.1/112860 1014182895 Thesis: M. Eng., Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, 2016. Cataloged from PDF version of thesis. Includes bibliographical references (pages 95-97). The lack of memory safety in C/C++ programs is one of, if not the, most persistent and costly sources of program exploits. Attacks based on memory corruption can range from the reading of private data to a complete hostile takeover of a process. While many solutions to this problem have been proposed, it is as of yet unsolved-as old memory corruption attacks are rendered obsolete, new attacks continually spring up. This lack of success is largely due to the trade-offs that memory safety solutions make between completeness, compatibility, and overhead. There no a single solution with all three properties, and a solution must have all three in order to once-and-for-all solve the lack of memory safety in C programs: If a solution is incomplete, attackers will find a workaround. Unless it is backwards compatible and low-overhead, it will not be deployed in production. My goal for this thesis was to take an existing system which is close to having all three properties, and add the missing property. I chose to work with SoftboundCETS an LLVM pass which is already complete and backwards compatible, but has high runtime overhead. In this thesis, I take SoftboundCETS and heavily optimize its runtimes, reducing its total overhead by half. I split the original pass into two separate passes (one to mark which instructions were to be instrumented and the second to do the actual instrumentation) and then insert several optimization passes between them. I test my results on selected benchmarks from SPEC2000 and SPEC2006, and create a virtual machine image which allows my results to be reliably reproduced. Lastly, I propose a number of further optimizations which would allow Softbound-CETS to achieve low enough overhead to be used in a mid-performance production system. by Eli Bristol Davis. M.Eng. 97 pages eng Massachusetts Institute of Technology MIT theses are protected by copyright. They may be viewed, downloaded, or printed from this source but further reproduction or distribution in any format is prohibited without written permission. http://dspace.mit.edu/handle/1721.1/7582 Electrical Engineering and Computer Science. Fast, compatible, complete memory safety For C programs Thesis application/pdf false Publication unknown unknown <Publication xmlns="https://www.openaire.eu/cerif-profile/1.1/" id="502ea0f4-a709-446e-aee2-cbcead4d5b19"> <Type xmlns="https://www.openaire.eu/cerif-profile/vocab/COAR_Publication_Types">http://purl.org/coar/resource_type/c_1843</Type> <Language>eng</Language> <Title>Fast, compatible, complete memory safety For C programs</Title> <PublishedIn> <Publication> </Publication> </PublishedIn> <PublicationDate>2016</PublicationDate> <Authors> <Author> <DisplayName>Davis, Eli Bristol</DisplayName> <Affiliation> <OrgUnit> </OrgUnit> </Affiliation> </Author> </Authors> <Editors> </Editors> <Publishers> <Publisher> <DisplayName>Massachusetts Institute of Technology</DisplayName> <OrgUnit /> </Publisher> </Publishers> <License>http://dspace.mit.edu/handle/1721.1/7582</License> <Keyword>Electrical Engineering and Computer Science.</Keyword> <Abstract>The lack of memory safety in C/C++ programs is one of, if not the, most persistent and costly sources of program exploits. Attacks based on memory corruption can range from the reading of private data to a complete hostile takeover of a process. While many solutions to this problem have been proposed, it is as of yet unsolved-as old memory corruption attacks are rendered obsolete, new attacks continually spring up. This lack of success is largely due to the trade-offs that memory safety solutions make between completeness, compatibility, and overhead. There no a single solution with all three properties, and a solution must have all three in order to once-and-for-all solve the lack of memory safety in C programs: If a solution is incomplete, attackers will find a workaround. Unless it is backwards compatible and low-overhead, it will not be deployed in production. My goal for this thesis was to take an existing system which is close to having all three properties, and add the missing property. I chose to work with SoftboundCETS an LLVM pass which is already complete and backwards compatible, but has high runtime overhead. In this thesis, I take SoftboundCETS and heavily optimize its runtimes, reducing its total overhead by half. I split the original pass into two separate passes (one to mark which instructions were to be instrumented and the second to do the actual instrumentation) and then insert several optimization passes between them. I test my results on selected benchmarks from SPEC2000 and SPEC2006, and create a virtual machine image which allows my results to be reliably reproduced. Lastly, I propose a number of further optimizations which would allow Softbound-CETS to achieve low enough overhead to be used in a mid-performance production system.</Abstract> <Access xmlns="http://purl.org/coar/access_right" > </Access> </Publication>