Abstract:—Many mechanisms have been proposed and de-ployed to prevent exploits against software vulnerabilities. Amongthem, W X is one of the most effective and efﬁcient. W Xprevents memory pages from being simultaneously writableand executable, rendering the decades old shellcode injectiontechnique infeasible.In this paper, we demonstrate that the traditional shellcodeinjection attack can be revived through a code cache injectiontechnique. Speciﬁcally, dynamic code generation, a techniquewidely used in just-in-time (JIT) compilation and dynamic binarytranslation (DBT), generates and modiﬁes code on the ﬂy in orderto promote performance or security. The dynamically generatedcode fragments are stored in a code cache, which is writableand executable either at the same time or alternately, resultingin an opportunity for exploitation. This threat is especiallyrealistic when the generated code is multi-threaded, becauseswitching between writable and executable leaves a time windowfor exploitation. To illustrate this threat, we have crafted a proof-of-concept exploit against modern browsers that support WebWorkers.To mitigate this code cache injection threat, we propose anew dynamic code generation architecture. This new architecturerelocates the dynamic code generator to a separate process,in which the code cache is writable. In the original processwhere the generated code executes, the code cache remains read-only. The code cache is synchronized across the writing processand the execution process through shared memory. Interactionbetween the code generator and the generated code is handledtransparently through remote procedure calls (RPC). We haveported the Google V8 JavaScript engine and the Strata DBTto this new architecture. Our implementation experience showedthat the engineering effort for porting to this new architectureis minimal. Evaluation of our prototype implementation showedthat this new architecture can defeat the code cache injectionattack with small performance overhead.

A Flexible Generator Architecture for Improving Software Dependability.

Tools to Make C Programs Safe: a Deeper Study

An Automated Approach to Increasing the Robustness of C Libraries

Xml-Enabled Wrapper Generation

Generation-based Fuzzing? Don’t Build a New Generator, Reuse!

Webc: Toward A Portable Framework for Deploying Legacy Code in Web Browsers

Exploiting and Protecting Dynamic Code Generation.

A^3-CodGen: A Repository-Level Code Generation Framework for Code Reuse with Local-Aware, Global-Aware, and Third-Party-Library-Aware

Design and Implementation of Binary Utilities Generator

Generators-Of-Generators Library With Optimization Capabilities In Fortress

An Approach to Reliable Software Architectures Evolution

Automatic Wrapper Generation and Maintenance.

Software design for reliability and reuse: a proof-of-concept demonstration

Flexible Development of Dependability Services: An Experience Derived from Energy Automation Systems

Effective Generation of Interface Robustness Properties for Static Analysis

Refactoring Java Code for Automatic API Generation

A General Pattern-Based Dynamic Compilation Framework for Coarse-Grained Reconfigurable Architectures.

Generating and Inferring Interface Properties for Static Analysis

A Practical Framework for Dynamically Immunizing Software Security Vulnerabilities

DamGate: Dynamic Adaptive Multi-feature Gating in Program Binaries.