Return-oriented programming (ROP) is a computer security exploit technique that allows an attacker to execute code despite the presence of security defenses that would otherwise prevent it, such as executable-space protection and code signing.
In this technique, an attacker gains control of the call stack to hijack program control flow and then executes carefully chosen machine instruction sequences that are already present in the machine's memory, called "gadgets". Each gadget typically ends in a return instruction and is located in a subroutine within the existing program and/or shared library code. Chained together, these gadgets allow an attacker to perform arbitrary operations on a machine employing defenses that catch simpler attacks.
callf with the instruction sequence
ret with the instruction sequence
table represents an immutable tabulation of all "legitimate" return addresses in the program and
– return-oriented programming is a rediscovery of threaded code Vázquez, Hugo (2007-10-01).
"Check Point Secure Platform Hack" (PDF).
Pentest. Barcelona, Spain: Pentest Consultores. p.
219.
↑ Buchanan, E.; Roemer, R.; Shacham, H.; Savage, S. (October 2008). "When Good Instructions Go Bad: Generalizing Return-Oriented Programming to RISC" (PDF). Proceedings of the 15th ACM conference on Computer and communications security - CCS '08. pp. 27–38. doi:10.1145/1455770.1455776. ISBN 978-1-59593-810-7. S2CID 11176570.
↑ Microsoft Windows XP SP2 Data Execution Prevention
↑ Solar Designer, Return-into-lib(c) exploits, Bugtraq
↑ Nergal, Phrack 58 Article 4, return-into-lib(c) exploits
↑ Sebastian Krahmer, x86-64 buffer overflow exploits and the borrowed code chunks exploitation technique, September 28, 2005
↑ Shacham, H. (October 2007). "The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)". Proceedings of the 14th ACM conference on Computer and communications security - CCS '07. pp. 552–561. doi:10.1145/1315245.1315313. ISBN 978-1-59593-703-2. S2CID 11639591.
↑ Jonathan Salwan and Allan Wirth, ROPgadget - Gadgets finder and auto-roper
↑ [Shacham et al., 2004] Hovav Shacham, Matthew Page, Ben Pfaff, Eu-Jin Goh, Nagendra Modadugu, and Dan Boneh. On the effectiveness of address-space randomization. In Proceedings of the 11th ACM conference on Computer and Communications Security (CCS), 2004.
↑ [Bennett et al., 2013] James Bennett, Yichong Lin, and Thoufique Haq. The Number of the Beast, 2013. https://www.fireeye.com/blog/threat-research/2013/02/the-number-of-the-beast.html Archived 2017-02-22 at the Wayback Machine
↑ Checkoway, S., Davi, L., Dmitrienko, A., Sadeghi, A.-R., Shacham, H., Winandy, M. 2010. Return-oriented programming without returns. In Proceedings of CCS 2010, A. Keromytis and V. Shmatikov, Eds. ACM Press, 559–572
↑ Onarlioglu, K., Bilge, L., Lanzi, A., Balzarotti, D., Kirda, E. 2010. G-Free: Defeating return-oriented programming through gadget-less binaries. In Proceedings of ACSAC 2010, M. Franz and J. McDermott, Eds. ACM Press, 49–58.
↑ USapplication 2019347385,Shelly, Asaf,"Security methods and systems by code mutation",published 2019-11-14 , since abandoned.
↑ Francillon, A., Perito, D., Castelluccia, C. 2009. Defending embedded systems against control flow attacks. In Proceedings of SecuCode 2009, S. Lachmund and C. Schaefer, Eds. ACM Press, 19–26.
1 2 3 4 Li, Jinku; Wang, Zhi; Jiang, Xuxian; Grace, Mike; Bahram, Sina. Defeating return-oriented rootkits with "return-less" kernels. In Proceedings of EuroSys 2010, edited by G. Muller. ACM Press, 195–208.
↑ "Linux 5.7 For 64-bit ARM Brings In-Kernel Pointer Authentication, Activity Monitors - Phoronix". www.phoronix.com. Retrieved 2020-03-31.
↑ "Control Flow Integrity, anti-malware active protection on Arm64 systems" (PDF). sipearl.com. Retrieved 2024-02-04.
"Return-oriented Programming Attack Demo video". YouTube.