noseatbelt

Remove mitigations from (running!) software.

This library detects and removes mitigations (Spectre, CFG, ...) from a running program and also applies some optimizations.

Currently WIP.

Transformations

Currently the following transformations are applied:

• indirect calls via retpolines to direct calls (Spectre mitigation removal)
• returns via return thunks to direct returns (Spectre mitigation removal)
• Control Flow Integrity checks removed (Windows CFG)
• Control Flow Integrity checks removed (LLVM and others)
• inlining of JMP instructions (to RET or JMP)
• redirecting of CALL instructions (to JMP or another CALL)
• inlining of functions

Support

• Linux 64bit
• Linux 32bit
• Windows 64bit
• Windows 32bit

Build

mkdir build
cd build
cmake -DCMAKE_BUILD_TYPE=Debug ../ #Release is default
make

Usage

# Measure how long it takes to patch the firefox binary
time LD_PRELOAD=./libnoseatbelt-auto.so firefox --version