Smashing the Gadgets: Hindering Return-Oriented Programming Using In-place Code Randomization

By Vasilis Pappas, Michalis Polychronakis, Angelos Dennis Keromytis. IEEE Symposium on Security and Privacy, 2012

405 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Materials Chemistry, Signal Processing

View Paper: https://www.semanticscholar.org/paper/303a6585a9a8a48f6213e696437b411fb3e7aa63

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Materials Chemistry

In Signal Processing

Citations in the corpus

ROP is Still Dangerous: Breaking Modern Defenses (2014, methodology): “Another technique replaces short sequences of instructions with alternate, functionally-identical, equal-length sequence, hindering an attacker’s ability to use unintended gadgets [22].”
ROPecker: A Generic and Practical Approach For Defending Against ROP Attacks (2014, methodology): “its great threat, recent years have witnessed many proposed methods (Table I) to defend against ROP attacks [18], [13], [9], [15], [6], [20], [28], [34], [32], [14], [33].”
Control Flow Integrity for COTS Binaries (2013, methodology): “[33] uses static in-place randomization (IPR) to eliminate gadgets.”
Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization (2013, methodology): “To address this limitation, several proposals have emerged [23, 45, 62].”
SGX-Shield: Enabling Address Space Layout Randomization for SGX Programs (2017, methodology): “many fine-grained ASLR techniques [13, 23, 24, 32, 45, 59] claim that randomizing the code in various fine-grained units (e.”
SoK: Automated Software Diversity (2014, methodology): “Some static binary rewriters omit these compensation mechanisms [47], [21].”
The Cybersecurity Landscape in Industrial Control Systems (2016, background): “To tackle this limitation, a number of fine-grained ASLR schemes have been proposed [115]– [120].”
Hacking in Darkness: Return-oriented Programming against Secure Enclaves (2017, background): “As shown in [28], the useful gadget that can be exploited to launch Dark-ROP can be eliminated before the enclave is deployed.”
Practical Control Flow Integrity and Randomization for Binary Executables (2013, methodology): “Unlike other recent work [18][31], CCFIR randomizes each stub in the Springboard at load-time.”
Hacking Blind (2014, background): “Additional techniques exist to try to randomize gadget locations on a per instance run, but these offer no defense against BROP unless the binary is fully restarted (fork and exec) [25], [26].”
SoK: Eternal War in Memory (2013, methodology): “Researchers propose techniques to eliminate useful code chunks (for ROP) from the code by the compiler [20], or by binary rewriting [21].”
Jump over ASLR: Attacking branch predictors to bypass ASLR (2016, background): “These schemes enforce the enhanced randomization at different levels, such as at the level of functions [31], basic blocks [48] or instructions [49], [50].”
Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications (2015, background): “In general, one can distinguish between two phases of a runtime exploit: (1) the exploitation of a memory corruption vulnerability initially allowing the adversary to hijack the control flow of an application, and (2) the actual adversary-chosen malicious computations and program actions that…”
Out of Control: Overcoming Control-Flow Integrity (2014, background): “As a result, many proposals where introduced for fine grained randomization in executables by applying in-place randomization [39], breaking the linearity of the address-space [40], or shuffling the basic code blocks of a program [41].”