oh i see grsecurity has /finally/ published their RAP thing, and they still claim it is “ROP-proof”. I guess I should go break it.

took a very quick look - am I missing something or is there no protection on memcpy? is that something reserved for the full version? -_-

and on some functions the return address check is just wrong. like this - see the problem? ghostbin.com/paste/kwznb

this is why the commercial version is claimed to be ROP-proof. lots of little things under the hood there ;).

pax_ret is the return addr encryption, right? well, I'd be interested in seeing the implementation… if it ever becomes public