ROPdefender: a detection tool to defend against return-oriented programming attacks

By Lucas Davi, Ahmad-Reza Sadeghi, Marcel Winandy. ACM Asia Conference on Computer and Communications Security, 2011

309 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/d99fa6bcfdb7dcc19abb4512e3917e2266ae0b35

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications (2015, methodology): “If X ′ is equal to X , it is in general difficult for an attacker to divert control flow in a way that is not conform to the semantics of a program’s source code.”
Return-oriented programming without returns (2010, background): “, TRUSS [42] and ROPdefender [13]; and, finally, hardwarefacilitated solutions [16, 17].”
ILR: Where'd My Gadgets Go? (2012, methodology): “ROPDefender [15] and TRUSS [37] look for mismatched calls and returns essentially using a shadow stack.”
Return-Oriented Programming: Systems, Languages, and Applications (2012, background): “Defenses against return-oriented programming have been proposed that depend on its use of return instructions [Chen et al. 2009; Davi et al. 2009, 2011; Francillon et al.”
Privilege Escalation Attacks on Android (2010, background): “, [31,5,13,8]), since it relies on indirect jumps rather than returns.”
Practical Control Flow Integrity and Randomization for Binary Executables (2013, background): “More comprehensive ROP protections, such as ROPdefenser [30] and ILR [18] introduce high overhead.”
Binary stirring: self-randomizing instruction addresses of legacy x86 binary code (2012, background): “However,asdemonstrated by DROP [17] and ROPdefender [23], these systems tend to exhibit signiﬁcantly higher overheads.”
Control Flow Integrity for COTS Binaries (2013, background): “The introduction of JOP [10, 7] eliminates the need to use return instructions to effect ICF transfers, thereby defeating defenses that rely on the use of (repeated) returns [11, 14, 32].”
ROP is Still Dangerous: Breaking Modern Defenses (2014, background): “ROPdefender [12] implements a shadow-stack and verifies that all returns exist somewhere on the shadow-stack.”
ROPecker: A Generic and Practical Approach For Defending Against ROP Attacks (2014, background): “ROPecker: A Generic and Practical Approach for Defending Against ROP Attacks Yueqiang Cheng†, Zongwei Zhou§, Miao Yu§, Xuhua Ding†, Robert H. Deng† † School of Information Systems, Singapore Management University † {yqcheng.2008, xhding, robertdeng}@smu.edu.sg § ECE Department and CyLab, Carnegie Me”
Out of Control: Overcoming Control-Flow Integrity (2014, unknown): “ROPDefender [37] is another approach, also using a shadow stack, that aims to enforce a call-ret pairing policy, therefore any ret instructions which have not been triggered by a call will be detected.”
Jump-oriented programming: a new class of code-reuse attack (2011, methodology): “Some enforce the LIFO stack invariant [18, 21], some detect excessive execution of the ret instruction [15, 17], and one went so far as to eliminate every instance of the ret opcode from the kernel binary [30].”