ARG: Automatic ROP Chains Generation

Abstract

Return Oriented Programming (ROP) chains attack has been widely used to bypass Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) protection. However, the generation technology for ROP chains is still in a state of manual coding. While, current techniques for automatically generating ROP chains are still insufficiently researched and have few successful applications. On the other hand, the existing methods are based on using Intermediate Language (IL) which is in order to translate the semantics of original instructions for symbolic execution, and then fill in a predefined gadget arrangement to automatically construct a gadget list. This kind of methods may bring following problems:(1) when converting semantics of original to IL, there is a large amount of overhead time, critical instructions may be discarded; (2) the process of populating a predetermined gadget arrangement is inflexible and may fail to construct ROP chains due to address mismatching. In this paper, we propose the Automatic ROP chains Generation (ARG) which is the first fully automatic ROP chains generation tool without using IL. Tested with data from 6 open-source international Capture The Flag (CTF) competitions and 3 Common Vulnerabilities & Exposures (CVE)s, this technology successfully generated ROP chains for all of them. According to the obtained results, our technique can automatically create ROP payloads and reduce up to 80% of ROP exploit payloads. It takes only 3-5 seconds to exploit successfully, compared to manual analysis for at least 60 minutes, as well as it can effectively bypass both Write XOR Execute (W⊕X) and ASLR.INDEX TERMS AMOCO, automatic exploit generation, return oriented programming, satisfiability modulo theories, Z3 solver.

Securing Embedded System from Code Reuse Attacks: A Lightweight Scheme with Hardware Assistance

“…In response to the security threat posed by code reuse attacks, extensive research has been conducted on defense methods against such attacks. These include CRA defense methods based on randomization [ 15 , 16 ], protection methods based on CFI protection [ 17 ], and Data Execution Protection (DEP) [ 18 ].…”

“…DEP adopts a protection strategy that prohibits programs from simultaneously writing to and executing the same memory section, in order to prevent attackers from executing malicious code injected by the attackers. However, this defense method is vulnerable to bypassing through ROP and JOP attacks [ 18 ]. Randomization techniques are an effective defense against CRA attacks as they randomize code segments, data segments, and control flow paths within a program.…”

Pacman

“…A memory corruption attack exploits a software bug to corrupt the content of a memory location, which contains important data structures, such as data and code pointers. The set of attacks that modify code pointers to change the control flow of the victim program is called control-flow hijacking attacks, such as code injection attacks, return-oriented programming (ROP) [31,56,66], and jumporiented programming (JOP) [11,16].…”

“…These mitigations include stack canaries [19], data execution prevention [64], address space layout randomization (ASLR) [1,47], and kernel address space layout randomization (kASLR) [21]. Even though these mechanisms make memory corruption attacks more difficult, several advanced attacks [11,16,31,56,66] and various data disclosure attacks [29,59] still have the potential to bypass these memory protection mechanisms, and show that none of the existing systems are impenetrable.…”

Real-time Attack-Scheme Visualization for Complex Exploit Technique Comprehension

“…Recent cyber-attack techniques, especially control flow hijacking, are highly complex and numbers of variants of the techniques have been developed [10]. Furthermore, there are studies that automatically produce exploit codes for buffer overflows [11], ROP chains [12], heap overflows [13], etc.…”