topic SGX cannot protect memory in Enclave from being accessed in Intel® Software Guard Extensions (Intel® SGX)

SGX cannot protect memory in Enclave from being accessed

Ray1 — Sun, 07 Apr 2019 06:15:38 GMT

Hi,

As I know,the core technology of SGX is to protect a memory area from being accessed by external environment, but I test that when I apply for a memory in Enclave,whatever in Real hardware mode or simulator mode, I can still access the memory in Enclave by calling OCALL outgoing address and using memory tools (such as Cheat Engine). And When I destroy the Encalve,the memory pointed by the address is also free.

I used the code sample in this tutorial as a test program : https://software.intel.com/en-us/node/701612

In this tutorial,He explained that the ECALL parameter passing without the user_check flag, the parameter address in non-secure area and the safe area will be different. But these two pointers can be accessed externally (For example, using Cheat Engine), then it's meaningless even if the two addresses are different.

Are there any mistakes in my steps?

Thank you.

I used the code sample in

Ray1 — Sun, 07 Apr 2019 06:19:00 GMT

In order to prevent an

Francisco_C_Intel — Tue, 09 Apr 2019 18:47:34 GMT

In order to prevent an enclave from being debugged, in the application, the enclave must be loaded in the non-debug mode.

To load an enclave in debug mode, the debugger flag (the second parameter of sgx_create_enclave) must be TRUE.

To load it in non-debug mode, you need to pass in FALSE.

See https://software.intel.com/en-us/blogs/2016/01/07/intel-sgx-debug-production-prelease-whats-the-difference , https://software.intel.com/en-us/forums/intel-software-guard-extensions-intel-sgx/topic/681473 , https://software.intel.com/en-us/forums/intel-software-guard-extensions-intel-sgx/topic/737509 for more information.

Thanks,

Francisco

引文：Francisco C. (Intel) 写道：

Ray1 — Thu, 11 Apr 2019 00:48:42 GMT

Francisco C. (Intel) wrote:
In order to prevent an enclave from being debugged, in the application, the enclave must be loaded in the non-debug mode.
To load an enclave in debug mode, the debugger flag (the second parameter of sgx_create_enclave) must be TRUE.
To load it in non-debug mode, you need to pass in FALSE.
See https://software.intel.com/en-us/blogs/2016/01/07/intel-sgx-debug-production-prelease-whats-the-difference , https://software.intel.com/en-us/forums/intel-software-guard-extensions-intel-sgx/topic/681473 , https://software.intel.com/en-us/forums/intel-software-guard-extensions-intel-sgx/topic/737509 for more information.

Thanks,
Francisco

Thank you so much！

Ray