[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <54821BBF.8080103@gmail.com>
Date: Fri, 05 Dec 2014 15:55:27 -0500
From: Daniel Micay <danielmicay@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Offset2lib: bypassing full ASLR on 64bit Linux
On 05/12/14 02:59 PM, Hanno Böck wrote:
> Okay, I'm surprised to see that while everyone seems to claim
> performance reasons are why we don't use fpic/pie by default I can't
> find anyone actually benchmarking it.
>
> *disclaimer: benchmarking is tricky business, I don't know if I messed
> something up. If you feel this is a completely wrong way to benchmark
> this I'm open to suggestions. *
>
> I decided a reasonable target would be a static compile of ffmpeg,
> because it does some complicated stuff.
> I compiled two copies mostly identical with the difference that for one
> I passed CFLAGS="-O2" LDFLAGS="" while for the other I passed
> CFLAGS="-O2 -fpic" LDFLAGS="-pie".
>
> I then converted a h264 video to mpeg4.
>
> This is what I got:
> no pie/pic: 14.664, 14.606, 14.685, 14.719, 14.69, average: 14.6728
> pie/pic: 14.776, 14.951, 14.947, 14.798, 14.898, average: 14.874
>
> So it seems the difference is at least measurable (around 1,4%) but not
> big.
>
> I haven't benchmarked with the patches Florian referred to, they
> involve patching gold and gcc (the above is done with classic ld).
The context of the architecture you're testing on is required for the
numbers to be meaningful. It's known to be expensive on x86 and should
be nearly free elsewhere if there aren't compiler / linker perf bugs.
The cost on x86 is also quite different with Clang, and will be
improving in the next GCC release due to register allocator improvements.
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
