Questions about PLT/GOT redirection

Hi,

I have a few questions about relocating PLT/GOT in
binaries to act as a first line of defense against
return-to-plt exploits.

If I move the PLT/GOT to a new location and update
the references in PLT, update dynsym, update some
other variables and change calls to PLT, to calls to
new_PLT, it works fine, except for cases where someone
has stored a pointer to function. In this case, I need
to figure out that the indirect call will land into
the PLT. I have a round about way to deal with this.

Are there any good ways of doing this? Are there
other cases where moving the PLT/GOT of a binary
could cause issues? Are there any simple ways in which
this could still be subverted?













		
__________________________________
Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo