W^X now mandatory in OpenBSD
This paper's thesis is that W^X does not work, and not because of any of the reasons presented in this thread: <a href="https://cseweb.ucsd.edu/~hovav/dist/geometry.pdf" rel="nofollow">https://cseweb.ucsd.edu/~hovav/dist/geometry.pdf</a><p>The paper says that to bypass W^X protection, you can simply scan an executable for "the instruction you want to use, followed by a RET". The paper calls these "gadgets."<p>You can write any function you want by using these gadgets: simply call them. When you call a gadget, it executes the corresponding instruction, then returns. This allows you to write arbitrary functions, since real-world programs are large enough that they have a massive number of gadgets for you to choose from.<p>Can someone provide a counterargument?