ARG: Automatic ROP Chains Generation

IEEE Access

Jing Gao¹  Ennan Zheng²  Yuan Wei³  Senlin Luo³  Bo Li³  Limin Pan³  Jianwei Zhuge⁴ 

[1] Beijing Gehua CATV Network Co., Ltd., Beijing, China;Department of Information Technology, University of International Relations, Beijing, China;Information System and Security & Countermeasures Experimental Center, Beijing Institute of Technology, Beijing, China;Institute of Network Science and Cyberspace, Tsinghua University, Beijing, China;

关键词: AMOCO;    automatic exploit generation;    return oriented programming;    satisfiability modulo theories;    Z3 solver;   

DOI  :  10.1109/ACCESS.2019.2937585

来源: DOAJ

【 摘 要 】

Return Oriented Programming (ROP) chains attack has been widely used to bypass Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) protection. However, the generation technology for ROP chains is still in a state of manual coding. While, current techniques for automatically generating ROP chains are still insufficiently researched and have few successful applications. On the other hand, the existing methods are based on using Intermediate Language (IL) which is in order to translate the semantics of original instructions for symbolic execution, and then fill in a predefined gadget arrangement to automatically construct a gadget list. This kind of methods may bring following problems: (1) when converting semantics of original to IL, there is a large amount of overhead time, critical instructions may be discarded; (2) the process of populating a predetermined gadget arrangement is inflexible and may fail to construct ROP chains due to address mismatching. In this paper, we propose the Automatic ROP chains Generation (ARG) which is the first fully automatic ROP chains generation tool without using IL. Tested with data from 6 open-source international Capture The Flag (CTF) competitions and 3 Common Vulnerabilities & Exposures (CVE)s, this technology successfully generated ROP chains for all of them. According to the obtained results, our technique can automatically create ROP payloads and reduce up to 80% of ROP exploit payloads. It takes only 3-5 seconds to exploit successfully, compared to manual analysis for at least 60 minutes, as well as it can effectively bypass both Write XOR Execute (W⊕X) and ASLR.

【 授权许可】

Unknown