lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]

As anyone who has tracked Lua 5.2's development will likely know, the
bytecode verifier was removed, and the responsibility shifted to the
end-developer to ensure that bytecode from untrusted sources couldn't
be loaded. To show just how important this responsibility is, I've
written up a pure Lua module for the default Lua 5.2 (-work4)
interpreter which can read and write arbitrary memory locations. The
only thing standing between this and a generic
arbitrary-code-execution exploit is DEP (hardware/OS level memory page
protection preventing where code can be executed from).

The code is available at: