When good instructions go bad: generalizing return-oriented programming to RISC

By Erik Buchanan, Ryan Roemer, Hovav Shacham, Stefan Savage. Conference on Computer and Communications Security, 2008

441 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Hardware and Architecture, Signal Processing

View Paper: https://www.semanticscholar.org/paper/bc6be5f3f1cf582c3613e3c7de6a793947335854

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Signal Processing

Citations in the corpus

ROP is Still Dangerous: Breaking Modern Defenses (2014, background): “For a more complete introduction, we refer the reader to [7] [25] [27].”
SMART: Secure and Minimal Architecture for (Establishing Dynamic) Root of Trust (2012, background): “, return to libc [42], borrowed code chunks [27] or Return-Oriented Programming [39, 7, 9]).”
ILR: Where'd My Gadgets Go? (2012, methodology): “Our preliminary prototype, working on 32-bit x86 Linux ELF binaries, provides a high degree of entropy.”
Smashing the Gadgets: Hindering Return-Oriented Programming Using In-place Code Randomization (2012, background): “[6], [8], [26], [33], [67]–[69] led to its adoption in realworld attacks [10], [11].”
This Paper Is Included in the Proceedings of the 12th Usenix Symposium on Operating Systems Design and Implementation (osdi '16). Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data (unknown): “While we do not claim to prevent the execution-time channel, Ryoan does limit the use of this channel to once per request ( § 5.2).”
Return-Oriented Programming: Systems, Languages, and Applications (2012, background): “Two extended abstracts by this article s authors introduced return-oriented programming on the x86 [Shacham 2007] and SPARC [Buchanan et al. 2008].”
Jump-oriented programming: a new class of code-reuse attack (2011, background): “Copyright 2011ACM 978-1-4503-0564-8/11/03 ...$10.00. to redirect control .ow to the attacker-supplied code.”
Stitching the Gadgets: On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection (2014, methodology): “The applicability of ROP has been shown on many platforms including x86 [35], SPARC [7], and ARM [27].”
Return-oriented programming without returns (2010, methodology): “It was subsequently extended to the SPARC [3], Atmel AVR [15], PowerPC [26], Z80 [4], and ARM [23] processors.”
ROPdefender: a detection tool to defend against return-oriented programming attacks (2011, methodology): “The ROP attack method has been shown to be Turing-complete and its applicability has been demonstrated on a broad range of architectures: x86 [53], Atmel AVR [24], SPARC [8], ARM [38], Z80 [12], and PowerPC [41].”
Binary stirring: self-randomizing instruction addresses of legacy x86 binary code (2012, background): “…attackers began to redirect control ﬂows directly to potentially dangerous code already present in victim process address spaces (e.g., in standard libraries), bypassing W ⊕ X. Return-into-libc attacks [55] and return oriented programming (ROP) [12, 15, 51] are two major categories of such attacks.”
Hypervision Across Worlds: Real-time Kernel Protection from the ARM TrustZone Secure World (2014, unknown): “One example is return oriented attacks [16,28,51].”
SMART: Secure and Minimal Architecture for (Establishing a Dynamic) Root of Trust (2012, background): “, return to libc [42], borrowed code chunks [27] or Return-Oriented Programming [39], [7], [9]).”
Out of Control: Overcoming Control-Flow Integrity (2014, background): “Nevertheless, it has been shown that ROP is possible in RISC architectures [27], or it can be carried out without using the ret instruction [11], [12] making defenses that are based on the emulation of the ret command less effective [24].”
Hacking in Darkness: Return-oriented Programming against Secure Enclaves (2017, background): “This poses a problem for ROP attacks [8, 9, 32], as the attacker needs to find a vulnerability and gadgets in the victim’s code.”