The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)

By Hovav Shacham. Conference on Computer and Communications Security, 2007

1,596 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Hardware and Architecture, Signal Processing

View Paper: https://www.semanticscholar.org/paper/ea893ea12469cf870844c464b3cc106223174f45

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Signal Processing

Citations in the corpus

ROPecker: A Generic and Practical Approach For Defending Against ROP Attacks (2014, methodology): “[26], [7], [8].”
Code-pointer integrity (2014, background): “steal sensitive data or execute code that gives them control over a remote system [44, 37, 12, 8].”
Hacking in Darkness: Return-oriented Programming against Secure Enclaves (2017, background): “This poses a problem for ROP attacks [8, 9, 32], as the attacker needs to find a vulnerability and gadgets in the victim’s code.”
SGX-Shield: Enabling Address Space Layout Randomization for SGX Programs (2017, methodology): “ASLR is applied to commodity OS [3, 44] to defend against return-to-libc [42] and return-oriented-programming (ROP) attacks [49] by obfuscating locations of code gadgets.”
SMART: Secure and Minimal Architecture for (Establishing a Dynamic) Root of Trust (2012, background): “, return to libc [42], borrowed code chunks [27] or Return-Oriented Programming [39, 7, 9]).”
ROPdefender: a detection tool to defend against return-oriented programming attacks (2011, methodology): “Shacham [38] especially makes use of unintended instruction sequence ending in a return instruction to enforce ROP attacks.”
Return-oriented programming without returns (2010, methodology): “4 The trampo-4 Shacham observed [41, Section 5.1] that if ebx contains the address of a ret instruction then any instruction sequence ending in If, on the x86, we reserve a register y to store the trampoline’s address then sequences ending in an indirect jump through y will behave as though they the”
Data-Oriented Programming: On the Expressiveness of Non-control Data Attacks (2016, background): “ROP attacks are known to be Turing-complete because of a similar systematic construction [1], [23].”
Code injection attacks on harvard-architecture devices (2008, positive): “This fake stack is injected using sequences of instructions, called gadgets [23], already present in the sensor’s program memory.”
ILR: Where'd My Gadgets Go? (2012, background): “ROP gadgets and how they are combined to form an attack, please see Shacham’s prior work [2].”
Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing (2008, background): “Recent work by Shacham [20] builds a powerful attacker who can execute virtually arbitrary code using only a carefully crafted stack that causes jumps and calls into existing code.”
C-FLAT: Control-Flow Attestation for Embedded Systems Software (2016, background): “Keywords remote attestation; control-flow attacks; embedded system security”
SOK: (State of) The Art of War: Offensive Techniques in Binary Analysis (2016, methodology): “Such techniques work by translating a traditional, shellcodebased exploit into an equivalent exploit utilizing ReturnOriented Programming [52].”
Spectre Attacks: Exploiting Speculative Execution (2018, background): “Return-Oriented Programming (ROP) [63] is a technique that allows an attacker who hijacks control flow to make a victim perform complex operations by chaining together machine code snippets, called gadgets, found in the code of the vulnerable victim.”
SMART: Secure and Minimal Architecture for (Establishing Dynamic) Root of Trust (2012, background): “ROP allows execution of an arbitrary return-oriented program by merely manipulating the return addresses on the stack, i.e., without changing code.”
A Systematic Evaluation of Transient Execution Attacks and Defenses (2018, background): “Adopting established techniques from return-oriented programming (ROP) attacks [80], but abusing BTB poisoning instead of application-level vulnerabilities, selected code “gadgets” found in the victim ad-”
SgxPectre: Stealing Intel Secrets from SGX Enclaves Via Speculative Execution (2018, methodology): “Borrowing the term used in return-oriented programming [68] and Spectre attacks [44], we use gadgets to refer to these patterns.”