Abstract:—Many mechanisms have been proposed and de-ployed to prevent exploits against software vulnerabilities. Amongthem, W X is one of the most effective and efﬁcient. W Xprevents memory pages from being simultaneously writableand executable, rendering the decades old shellcode injectiontechnique infeasible.In this paper, we demonstrate that the traditional shellcodeinjection attack can be revived through a code cache injectiontechnique. Speciﬁcally, dynamic code generation, a techniquewidely used in just-in-time (JIT) compilation and dynamic binarytranslation (DBT), generates and modiﬁes code on the ﬂy in orderto promote performance or security. The dynamically generatedcode fragments are stored in a code cache, which is writableand executable either at the same time or alternately, resultingin an opportunity for exploitation. This threat is especiallyrealistic when the generated code is multi-threaded, becauseswitching between writable and executable leaves a time windowfor exploitation. To illustrate this threat, we have crafted a proof-of-concept exploit against modern browsers that support WebWorkers.To mitigate this code cache injection threat, we propose anew dynamic code generation architecture. This new architecturerelocates the dynamic code generator to a separate process,in which the code cache is writable. In the original processwhere the generated code executes, the code cache remains read-only. The code cache is synchronized across the writing processand the execution process through shared memory. Interactionbetween the code generator and the generated code is handledtransparently through remote procedure calls (RPC). We haveported the Google V8 JavaScript engine and the Strata DBTto this new architecture. Our implementation experience showedthat the engineering effort for porting to this new architectureis minimal. Evaluation of our prototype implementation showedthat this new architecture can defeat the code cache injectionattack with small performance overhead.

Runtime Code Reuse Attacks: A Dynamic Framework Bypassing Fine-Grained Address Space Layout Randomization.

Instantly Obsoleting the Address-code Associations: A New Principle for Defending Advanced Code Reuse Attack

De-randomizing the Code Segment with Timing Function Attack

Loop-Oriented Programming: A New Code Reuse Attack to Bypass Modern Defenses

WarpAttack: Bypassing CFI through Compiler-Introduced Double-Fetches

Different is Good

Defending ROP Attacks Using Basic Block Level Randomization

What You See is Not What You Get! Thwarting Just-in-Time ROP with Chameleon

Blender: Self-randomizing Address Space Layout for Android Apps

LoadLord: Loading on the Fly to Defend Against Code-Reuse Attacks

Layered Object-Oriented Programming: Advanced VTable Reuse Attacks on Binary-Level Defense

Exploiting and Protecting Dynamic Code Generation.

ROPocop - Dynamic Mitigation of Code-Reuse Attacks

Hardware-Assisted Fine-Grained Code-Reuse Attack Detection.

Lightweight and Seamless Memory Randomization for Mission-Critical Services in a Cloud Platform

A-R Exploit: an Automatic Rop Exploit Based on Long Sequence

A Static Recognition Mechanism For Indirect Call Based On Static Single Assignment

JITSafe: a Framework Against Just-in-time Spraying Attacks

Dynamic Runtime Detection System for Return-oriented Programming Attack

The Illusion of Randomness: An Empirical Analysis of Address Space Layout Randomization Implementations

Return-Oriented Rootkit Without Returns (on the X86)