Abstract:Return Oriented Programming (ROP) chains attack has been widely used to bypass Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) protection. However, the generation technology for ROP chains is still in a state of manual coding. While, current techniques for automatically generating ROP chains are still insufficiently researched and have few successful applications. On the other hand, the existing methods are based on using Intermediate Language (IL) which is in order to translate the semantics of original instructions for symbolic execution, and then fill in a predefined gadget arrangement to automatically construct a gadget list. This kind of methods may bring following problems: (1) when converting semantics of original to IL, there is a large amount of overhead time, critical instructions may be discarded; (2) the process of populating a predetermined gadget arrangement is inflexible and may fail to construct ROP chains due to address mismatching. In this paper, we propose the Automatic ROP chains Generation (ARG) which is the first fully automatic ROP chains generation tool without using IL. Tested with data from 6 open-source international Capture The Flag (CTF) competitions and 3 Common Vulnerabilities & Exposures (CVE)s, this technology successfully generated ROP chains for all of them. According to the obtained results, our technique can automatically create ROP payloads and reduce up to 80% of ROP exploit payloads. It takes only 3-5 seconds to exploit successfully, compared to manual analysis for at least 60 minutes, as well as it can effectively bypass both Write XOR Execute (W circle plus X) and ASLR.

ROP Defense Using Trie Graph for System Security.

ROPNN: Detection of ROP Payloads Using Deep Neural Networks

ROPSentry: Runtime Defense Against ROP Attacks Using Hardware Performance Counters.

A Dynamic Detection Method Against ROP and JOP

Program Attack and Protection Based on Return-Oriented Programming

A Dynamic Detective Method Against ROP Attack on ARM Platform

Dynamic Runtime Detection System for Return-oriented Programming Attack

DROP: Detecting Return-Oriented Programming Malicious Code

A-R Exploit: an Automatic Rop Exploit Based on Long Sequence

The never ending war in the stack and the reincarnation of ROP attacks

Efficient Detection Of The Return-Oriented Programming Malicious Code

ROPocop - Dynamic Mitigation of Code-Reuse Attacks

Arg: Automatic Rop Chains Generation

deRop: removing return-oriented programming from malware

Packed, printable, and polymorphic return-oriented programming

Return-Oriented Rootkit Without Returns (on the X86)

Automatic Construction of Jump-Oriented Programming Shellcode (on the X86)

DeepReturn: A Deep Neural Network Can Learn How to Detect Previously-Unseen ROP Payloads Without Using Any Heuristics

Universal Availability of ROP-Based Turing-Complete Computation

Defending ROP Attacks Using Basic Block Level Randomization

What You See is Not What You Get! Thwarting Just-in-Time ROP with Chameleon